Document that OpenVPN 2.3 does not check the CRL signature

---
 doc/openvpn.8 | 9 +++++++++
 1 file changed, 9 insertions(+)

index 612cddd..284e8e6 100644
@@ -5208,6 +5208,15 @@ Note: As the crl file (or directory) is read every time a peer connects,
 if you are dropping root privileges with
 .B \-\-user,
 make sure that this user has sufficient privileges to read the file.
+
+.B Security considerations
+
+.B \-\-crl\-verify
+does not check whether the CRL is correctly signed by the CA.  It merely checks
+that the CRL issuers matches the CA CN.  Therefore, users should ensure that
+the supplied CRL is correct.
+
+OpenVPN 2.4 and newer resolve this issue.
 .\"*********************************************************
 .SS SSL Library information:
 .\"*********************************************************

2.7.4

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ACK.

Your patch has been applied to the release/2.3 branch

commit 51d936d0c762a280923c9267c2b4fa154f905b9a

Author: Steffan Karger
Date:   Wed May 10 21:50:44 2017 +0200

     Document that OpenVPN 2.3 does not check the CRL signature

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: David Sommerseth <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg14626.html
     Signed-off-by: David Sommerseth <[email protected]...>

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBCAAGBQJZFJVjAAoJEIbPlEyWcf3yk2sP/1sArghqIw0o382n/pjXsncF l+JmZyTyM5ccM8+KVK1dL0Qo9Wu1YthGZuUitPmW+0SZa3Px72q7m56LdTtDWkWL CMjCJFaOM1VeODhNdxlBX78MnxzlYLOoyzrSoeFmOzk6U6ROhNLXvpnybz+TkGZU EQ+eHu+hc8pQwwXTzpcLPewK/aBvCq9YzNSHeyfVc3kA6GwH4qOSJqw4EyXYBEnR OcyN56KM7lXg3OKwn3qL7EH1kwe5eMu46cMYJeKua3ZY8rkzxpRTtlGkBOoA3GG5 a9iXmRU2j8nL5oXTNy/+vaeksrkkIeDkGv/kbhaoPpqUL2srJQ6ZaX9qOSKUdtdM uRkRG3PzX37EbBXUxJP2RiXNcYTxsJpfsHGBJpWTpPY4Hh0ZQ50rpzwrdZDlrqn9 h6PgimF39V3VNgvq4kC0X71Ozll7M2ai/zR1+wXR3EQ4gvmwgBff21ztEjpUPODC wAOboSIjP/al0/9aUSmjxoaI47ecCOaNq9eZUq0gfVhfeqZjaAlNnJwevqKr89Dl jWsEk0+UDwDQZop6HnVSNuplzgjVhON1hiimSE0SqlOxj8P8EhoM8hSJM7024gOU 5dcZoNPWBJor9Cscr+e5lrRxyVQEjO5h45GRtr58/kGEhJ/BJXEDEtjjN/VmypSi 5/OVZ1ljUAGsv/ppjCV5
=Qf/u
-----END PGP SIGNATURE-----