voms-proxy-init fails on expired legacy-hash CRL

[maarten-litmaath]

The voms-proxy-init command fails on an expired CRL whose filename is based on the legacy hash algorithm, while the corresponding CRL with the modern-hash filename actually is valid:

$ date
Tue Aug 11 12:27:46 AM CEST 2026
$ ll /etc/grid-security/certificates/ | grep CERN-Grid | grep '\.0'
lrwxrwxrwx. 1 root     root        15 Jul 13 20:03 4339b4bc.0 -> CERN-GridCA.pem
lrwxrwxrwx. 1 root     root        15 Jul 13 20:03 5168735f.0 -> CERN-GridCA.pem
$ openssl x509 -noout -hash -in /etc/grid-security/certificates/CERN-GridCA.pem 
5168735f
$ openssl crl -noout -nextupdate -in /etc/grid-security/certificates/5168735f.r0 
nextUpdate=Aug 14 15:16:01 2026 GMT
$ openssl crl -noout -nextupdate -in /etc/grid-security/certificates/4339b4bc.r0 
nextUpdate=Aug 10 15:16:01 2026 GMT
$ voms-proxy-init --version
voms-proxy-init v. 3.3.7 (voms-api-java/3.3.7 canl/2.8.3 bcprov/1.70.0 bcpkix/1.70.00.0)
$ voms-proxy-init -n -cert $X509_USER_PROXY -key $X509_USER_PROXY -out /tmp/tmp-$$.pem -voms alice
Certificate validation error: Signature of a CRL corresponding to this certificates CA is invalid
User credential is not valid!
$ 

When the legacy-hash file is removed, the command works fine.

Presumably, this is a problem with an underlying library, but perhaps it could be configured to succeed in such cases?

[maarten-litmaath]

For the record, voms-proxy-init2 works fine in such situations, using OpenSSL under the hood.