openssl verify には証明書を検証するためのオプションがいろいろ用意されているようにみえるが、man と help で乖離がある
man にはある attime オプションは指定した時刻で証明書が有効かを確認できて便利そうだったが、結局現時点では存在しないようだ
man にはある crlfile オプションも存在しないが、これは CAfile オプションで代替でき、 crl_check/crl_check_all 自体は機能する

$ openssl version
OpenSSL 1.0.2g  1 Mar 2016

man では便利そうなオプションがいろいろあるように見える。ここでは attime と crl_check_all を使おうとした。

$ man verify
SYNOPSIS
       openssl verify [-CApath directory] [-CAfile file] [-purpose purpose] [-policy arg]
       [-ignore_critical] [-attime timestamp] [-check_ss_sig] [-crlfile file] [-crl_download]
       [-crl_check] [-crl_check_all] [-policy_check] [-explicit_policy] [-inhibit_any]
       [-inhibit_map] [-x509_strict] [-extended_crl] [-use_deltas] [-policy_print]
       [-no_alt_chains] [-untrusted file] [-help] [-issuer_checks] [-trusted file] [-verbose] [-]
       [certificates]

DESCRIPTION
       The verify command verifies certificate chains.

COMMAND OPTIONS
...
       -crlfile file
           File containing one or more CRL's (in PEM format) to load.
...
       -attime timestamp
           Perform validation checks using time specified by timestamp and not current system
           time. timestamp is the number of seconds since 01.01.1970 (UNIX time).
...
       -crl_check_all
           Checks the validity of all certificates in the chain by attempting to look up valid
           CRLs.

...

コマンドのヘルプ。使えるオプションが man より少ない？

openssl verify -help

usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check] [-no_alt_chains] [-attime timestamp] [-engine e] cert1 cert2 ...
recognized usages:
	sslclient 	SSL client
	sslserver 	SSL server
	nssslserver	Netscape SSL server
	smimesign 	S/MIME signing
	smimeencrypt	S/MIME encryption
	crlsign   	CRL signing
	any       	Any Purpose
	ocsphelper	OCSP helper
	timestampsign	Time Stamp signing

attime はいかんともしがたかったが、crl_check_all は CAfile に CA証明書と一緒に入れることで検証できた。

$ #cross root:OldWithNew
$ openssl x509 -outform PEM -in $(pwd)/ca/selfsign-ca-2/cacert.pem  > /tmp/$$.pem
$ openssl crl  -outform PEM -in $(pwd)/ca/selfsign-ca-2/crl.pem    >> /tmp/$$.pem
$ openssl x509 -outform PEM -in $(pwd)/ca/selfsign-ca-2/certs/selfsign-ca-1/cert.pem  >> /tmp/$$.pem
$ openssl crl  -outform PEM -in $(pwd)/ca/selfsign-ca-1/crl.pem    >> /tmp/$$.pem
$ openssl x509 -outform PEM -in $(pwd)/ca/server-ca-1/cacert.pem   >> /tmp/$$.pem
$ openssl crl  -outform PEM -in $(pwd)/ca/server-ca-1/crl.pem      >> /tmp/$$.pem
$ openssl verify -CAfile /tmp/$$.pem -crl_check_all -purpose sslserver -issuer_checks -verbose ./ca/server-ca-1/certs/581BD4AC-www.example.com/cert.pem 
./ca/server-ca-1/certs/581BD4AC-www.example.com/cert.pem: OK
$ rm -f /tmp/$$.pem

CRL を CAfile に入れないと検証は失敗するので、間違えてはいないはず。

$ #cross root:OldWithNew
$ openssl x509 -outform PEM -in $(pwd)/ca/selfsign-ca-2/cacert.pem  > /tmp/$$.pem
$ openssl crl  -outform PEM -in $(pwd)/ca/selfsign-ca-2/crl.pem    >> /tmp/$$.pem
$ openssl x509 -outform PEM -in $(pwd)/ca/selfsign-ca-2/certs/selfsign-ca-1/cert.pem  >> /tmp/$$.pem
$ openssl crl  -outform PEM -in $(pwd)/ca/selfsign-ca-1/crl.pem    >> /tmp/$$.pem
$ openssl x509 -outform PEM -in $(pwd)/ca/server-ca-1/cacert.pem   >> /tmp/$$.pem
$ #openssl crl  -outform PEM -in $(pwd)/ca/server-ca-1/crl.pem      >> /tmp/$$.pem
$ openssl verify -CAfile /tmp/$$.pem -crl_check_all -purpose sslserver -issuer_checks -verbose ./ca/server-ca-1/certs/581BD4AC-www.example.com/cert.pem 
./ca/server-ca-1/certs/581BD4AC-www.example.com/cert.pem: CN = www.example.com
error 3 at 0 depth lookup:unable to get certificate CRL
$ rm -f /tmp/$$.pem

attime は追加されたあとすぐ削除されて、change log や man に残っているだけ、というパターンみたい。経緯はわからなかったが、復活しないのだろうか。