title: How to give CRL to openssl s_client?
body: <p>I'm testing certificate revocation with a test server. I'm trying to use <code>openssl s_client</code> with <em>crl_check</em> parameter for testing the revocation. I have appended ca certs to a chain file I give in <em>CAfile</em> parameter. </p>
  
  <p>With the command:</p>
  
  <pre><code>openssl s_client -connect &lt;host&gt;:&lt;port&gt; -crl_check -cert cert.pem \
  -key key.pem -CAfile ca_chain.pem -state -verify_return_error debug
  </code></pre>
  
  <p>I get a response:</p>
  
  <pre><code>Verify return code: 3 (unable to get certificate CRL)
  </code></pre>
  
  <p>Which is natural because I don't give the CRL.</p>
  
  <p><strong>How should I give the CRL</strong> (where the server cert is revoked) <strong>to the openssl s_client</strong> to get certificate revocation checked in negotiation?</p>