CRL parser
Decode a PEM or DER Certificate Revocation List into issuer, update times, and each revoked serial with its revocation date/reason. Reports what the CRL states, not whether it is current, or whether a given certificate is on it if you have not checked.
CRL parser reads a Certificate Revocation List, PEM or DER, and prints the version, signature algorithm, issuer, thisUpdate, nextUpdate and every revoked serial with its date and reason code. A missing nextUpdate shows as "(not present)" rather than vanishing. It never matches a serial for you and never weighs nextUpdate against your clock.
Questions
What does the output contain?
The CRL version, its signature algorithm, the issuer name, thisUpdate and nextUpdate as ISO timestamps, the number of revoked certificates, and one line per entry with the serial in hex, the revocation date, and any entry extensions such as the reason code. CRL level extensions like the CRL number and authority key identifier are listed at the end.
Can it tell me whether my certificate is revoked?
Not by itself. It lists every serial the CRL names, so you can search that list for the serial from x509-parse, which prints serials in the same even length hex form that openssl and CA portals use. There is no lookup, no matching step and no network request.
Does it check that the CRL is current or genuine?
No. It reports what the CRL states. There is no signature verification, no issuer chain check and no comparison of nextUpdate against your clock, so a stale or forged list parses exactly like a fresh one from the real issuer. Read the thisUpdate and nextUpdate lines and judge from those.
What if nextUpdate is missing?
The line reads "(not present)". That field is optional in RFC 5280, and the tool shows its absence rather than inventing a value or dropping the line. Everything else, including thisUpdate and every revocation date, prints as an ISO timestamp, so the values sort and compare cleanly.
Does it read PEM and DER?
Both, the same way as the certificate parser: a BEGIN line at the start means the base64 is decoded, otherwise the bytes are treated as DER. Drop as many files as you like and each is parsed on its own.