From: Nick Porter <nick@portercomputing.co.uk>
Date: Thu, 12 Jun 2025 17:01:23 +0000 (+0100)
Subject: Report CRL numbers when there is a mis-match error
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4eb26db5724da00d81689eec79087dc3fae65dbb;p=thirdparty%2Ffreeradius-server.git

Report CRL numbers when there is a mis-match error
---

diff --git a/src/modules/rlm_crl/rlm_crl.c b/src/modules/rlm_crl/rlm_crl.c
index 67210b48a73..9c9540a7fd8 100644
--- a/src/modules/rlm_crl/rlm_crl.c
+++ b/src/modules/rlm_crl/rlm_crl.c
@@ -359,13 +359,21 @@ static crl_entry_t *crl_entry_create(rlm_crl_t const *inst, fr_timer_list_t *tl,
 			goto error;
 		}
 		if (ASN1_INTEGER_cmp(base_num, base_crl->crl_num) != 0) {
-			fr_tls_strerror_printf("Delta CRL referrs to incorrect base CRL number");
+			uint64_t delta_base, crl_num;
+			ASN1_INTEGER_get_uint64(&delta_base, base_num);
+			ASN1_INTEGER_get_uint64(&crl_num, base_crl->crl_num);
+			fr_tls_strerror_printf("Delta CRL referrs to base CRL number %"PRIu64", current base is %"PRIu64,
+						delta_base, crl_num);
 			ASN1_INTEGER_free(base_num);
 			goto error;
 		}
 		ASN1_INTEGER_free(base_num);
 		if (ASN1_INTEGER_cmp(crl->crl_num, base_crl->crl_num) < 0) {
-			fr_tls_strerror_printf("Delta CRL number is less than base CRL number");
+			uint64_t delta_num, crl_num;
+			ASN1_INTEGER_get_uint64(&delta_num, crl->crl_num);
+			ASN1_INTEGER_get_uint64(&crl_num, base_crl->crl_num);
+			fr_tls_strerror_printf("Delta CRL number %"PRIu64" is less than base CRL number %"PRIu64,
+						delta_num, crl_num);
 			goto error;
 		}
 	}