title: openssl CLI - verify CRL of an entire certification chain
body: <p>I'm using OpenSSL to verify a signed code in a custom PKI. How can I verify the CRL of each node of the cert hierarchy.</p>
  
  <p>My hierarchy is : RootCA -> SubCA1 -> SubCA2 -> EndUser. I can verify the CRL for one depth chain :</p>
  
  <pre><code>~/$ cat RootCA.crl.pem RootCA.pem &gt; RootCA.chain.pem
  ~/$ openssl verify -check_crl -CAfile RootCA.chain.pem SubCA1.pem
  CN = SubCA1
  SubCA1.pem: OK
  </code></pre>
  
  <p>However, when I try to achieve the same thing with multiple subCA, the CRL validationf fails :</p>
  
  <pre><code>~/$ cat RootCA.crl.pem RootCA.pem &gt; RootCA.chain.pem
  ~/$ cat SubCA1.crl.pem SubCA1.pem &gt; SubCA1.chain.pem
  ~/$ openssl verify -check_crl -CAfile RootCA.chain.pem -untrusted SubCA1.chain.pem SubCA2.pem
  CN = SubCA1
  error 3 at depth 0 lookup: unable to get certificate CRL
  error SubCA2.pem: verification failed
  </code></pre>
  
  <p>Is it possible to achieve this multi-depth verification of the CRL ? I've also tried with -check_crl_all, but it give the same error.</p>