This function signs the fields of the CRL indicated in the SignScope parameter, in accordance with the specified cryptographic context. Once the CRL has been signed it may not be modified. This means that entries cannot be added or removed from the CRL through application of the CSSM_CL_CrlAddCert or CSSM_CL_CrlRemoveCert operations. A signed CRL can be verified, applied to a data store, and searched for values.

CSSM_DATA_PTR CSSMAPI CSSM_CL_CrlSign
                 (CSSM_CL_HANDLE CLHandle,
                 CSSM_CC_HANDLE CCHandle,
                 const CSSM_DATA_PTR UnsignedCrl,
                 const CSSM_DATA_PTR SignerCert,
                 const CSSM_FIELD_PTR SignScope,
                 uint32 ScopeSize)

Input

CLHandle

The handle that describes the CL module used to perform this function.

CCHandle

The handle that describes the context of this cryptographic operation.

UnsignedCrl

A pointer to the CSSM_DATA structure containing the CRL to be signed.

SignerCert

A pointer to the CSSM_DATA structure containing the certificate to be used to sign the CRL.

ScopeSize

The number of entries in the sign scope list. If the signing scope is not specified, the input scope size must be zero.

Input/optional

SignScope

A pointer to the CSSM_FIELD array containing the tag/value pairs of the fields to be signed. If the signing scope is NULL, the CL module includes a default set of CRL fields in the signing process.

A pointer to the CSSM_DATA structure containing the signed CRL. If the pointer is NULL, an error has occurred. Use CSSM_GetError to obtain the error code.

CSSM_CL_CrlVerify