AlinsRan · Oct 29, 2026 · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026
diff --git a/.licenserc.yaml b/.licenserc.yaml
@@ -31,6 +31,7 @@ header:
     - '**/*.sse'
     - '**/*.key'
     - '**/*.crt'
+    - '**/*.crl'
     - '**/*.pem'
     - '**/*.pb.go'
     - '**/pnpm-lock.yaml'

diff --git a/.requirements b/.requirements
@@ -17,5 +17,5 @@
 
 APISIX_PACKAGE_NAME=apisix
 
-APISIX_RUNTIME=1.4.0
+APISIX_RUNTIME=1.4.1
 APISIX_DASHBOARD_COMMIT=fa2fd0f60f8afffb096476333b9ba63b4c518fa3
diff --git a/apisix/cli/ngx_tpl.lua b/apisix/cli/ngx_tpl.lua
@@ -897,6 +897,7 @@ http {
 
         {% if ssl.ssl_trusted_certificate ~= nil then %}
         proxy_ssl_trusted_certificate {* ssl.ssl_trusted_certificate *};
+        grpc_ssl_trusted_certificate {* ssl.ssl_trusted_certificate *};
         {% end %}
 
         # opentelemetry_set_ngx_var starts

diff --git a/ci/linux-install-openresty.sh b/ci/linux-install-openresty.sh
@@ -61,19 +61,19 @@ else
     sudo apt-get -y update --fix-missing
     sudo apt-get install -y build-essential gcc g++ cpanminus libxml2-dev libxslt-dev
 
-    if [ "$APISIX_RUNTIME" != "1.4.0" ]; then
+    if [ "$APISIX_RUNTIME" != "1.4.1" ]; then
         echo "Please update the apisix-runtime-debug checksum for APISIX_RUNTIME=$APISIX_RUNTIME" >&2
         exit 1
     fi
 
     case "$ARCH" in
         x86_64|amd64)
             DEB_ARCH="amd64"
-            EXPECTED_SHA256="09d979543e65d6b16994d754f55ea759fe558fbb824fa8aed2ecd72a139b91b4"
+            EXPECTED_SHA256="c2c40dd7e86f6494c79f31433d840de9fa552491c8c6cddd49d237854aa5a4a1"
             ;;
         arm64|aarch64)
             DEB_ARCH="arm64"
-            EXPECTED_SHA256="d5803bd4c793332f0412968a85407a498de3b85c372edb65fcd0019aaaf05990"
+            EXPECTED_SHA256="1b337e0d068933f7c13c1d66002dd9e65b410e4ae8556c3362a8bc42a6ff7f8c"
             ;;
         *)
             echo "Unsupported architecture: $ARCH" >&2

diff --git a/docs/en/latest/admin-api.md b/docs/en/latest/admin-api.md
@@ -1059,7 +1059,7 @@ To use mTLS to communicate with Upstream, you can use the `tls.client_cert/key`
 
 Or you can reference SSL object by `tls.client_cert_id` to set SSL cert and key. The SSL object can be referenced only if the `type` field is `client`, otherwise the request will be rejected by APISIX. In addition, only `cert` and `key` will be used in the SSL object.
 
-To verify the certificate presented by the Upstream, set `tls.verify` to `true`. Leaving it unset keeps the behaviour configured in nginx, which is off unless `proxy_ssl_verify` is turned on. The certificate is checked against the CA certificates in `tls.ca_certs`, or against `ssl_trusted_certificate` from `config.yaml` when `tls.ca_certs` is not set:
+To verify the certificate presented by the Upstream, set `tls.verify` to `true`. Leaving it unset keeps the behaviour configured in nginx, which is off unless `proxy_ssl_verify` is turned on. The certificate is checked against the CA certificates in `tls.ca_certs`, or against `ssl_trusted_certificate` from `config.yaml` when `tls.ca_certs` is not set. In the latter case, a CRL configured in nginx with `proxy_ssl_crl` (`grpc_ssl_crl` for gRPC) is also checked:
 
 ```json
 {

diff --git a/docs/zh/latest/admin-api.md b/docs/zh/latest/admin-api.md
@@ -1063,7 +1063,7 @@ APISIX 支持两种不同的方式来代理 WebSocket 连接，二者不能混
 - `scheme` 可以设置成 `tls`，表示 `TLS over TCP`。
 - `tls.client_cert/key` 可以用来跟上游进行 mTLS 通信。他们的格式和 SSL 对象的 `cert` 和 `key` 一样。
 - `tls.client_cert_id` 可以用来指定引用的 SSL 对象。只有当 SSL 对象的 `type` 字段为 client 时才能被引用，否则请求会被 APISIX 拒绝。另外，SSL 对象中只有 `cert` 和 `key` 会被使用。
-- `tls.verify` 设置为 `true` 时校验上游返回的证书；不设置时沿用 nginx 的行为，即只有开启了 `proxy_ssl_verify` 才会校验。校验使用 `tls.ca_certs` 中的 CA 证书，未设置 `tls.ca_certs` 时使用 `config.yaml` 中的 `ssl_trusted_certificate`：
+- `tls.verify` 设置为 `true` 时校验上游返回的证书；不设置时沿用 nginx 的行为，即只有开启了 `proxy_ssl_verify` 才会校验。校验使用 `tls.ca_certs` 中的 CA 证书，未设置 `tls.ca_certs` 时使用 `config.yaml` 中的 `ssl_trusted_certificate`，此时 nginx 中通过 `proxy_ssl_crl`（gRPC 为 `grpc_ssl_crl`）配置的 CRL 同样生效：
 
   ```json
   {

diff --git a/t/certs/chain_root.crt b/t/certs/chain_root.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJzCCAg+gAwIBAgIUV8AvUI9ya6mg9hYhin2VQ84FFfMwDQYJKoZIhvcNAQEL
+BQAwGjEYMBYGA1UEAwwPY2hhaW4gdGVzdCByb290MCAXDTI2MTAyODEwMDUzM1oY
+DzIxMjYxMDA0MTAwNTMzWjAaMRgwFgYDVQQDDA9jaGFpbiB0ZXN0IHJvb3QwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCu55x4xUz64KTfiWVzPTPtFPHZ
+Q5cq+7S7lwmf9H4jEJ0aZwmMnPZRwcIQqhiYSdmqsNNi9iRST50IJdeoeT9hygCx
+6aS4zjKcLYHAayj30oxotMI6oTNkWmzz4Enf0AM4LhEqTuO+rO2/ZGYcdLEgWNb2
+1Tkm+HynIO0X+y9gML0mENdwz5u1c6ELWVZcNo6OCj2RZKWpAMX7BoclRr3NSOQ1
+UziXLOsHjfarkfKqi5vsoJ7S35AMNpUdcfBaUC4FvgMIeVje6kV+2m/Y07L57MaD
+jRA4/K7QDtbFbquVFA3fgWNqIyrUgzA1vGxcWJWzgyeSbipp+J+qVUK1AjrpAgMB
+AAGjYzBhMB0GA1UdDgQWBBRCSieNIEV+75ORkAIZLM1iwPaPizAfBgNVHSMEGDAW
+gBRCSieNIEV+75ORkAIZLM1iwPaPizAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
+/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAQEAmvoFXFkn7jTFp6jYTYDfzY1ZAfsc
+RDCvEGcrIWqyAJvgkro1jB5ddIz+ieeSx7A0G1Iq+5PdHFTYmaHnBO+cq0UySEs5
+eviLH1Z4seK4x/YEqWsBvW0rQO+zKovGVCbaPWRp8amVrHxgguC6hhq6tIYsb0L3
+yyIB0Ld+xsqXEbGKfmKhQmbSTBvedaH1DeoZw5PTHyAv/2Z5pZaXmyg63bxzLm/Q
+kkSd/K8st79pY8NNzMytXCQdZ8a/gG4pOkhlFdcRzDSi+20aMc7ymHbQnwStoyR1
+aNbP2SvVTHQ/Kpsr9hIfz+1CYGJ3WewhzJwPeZWn8CusPiHY4qbKrC4rRw==
+-----END CERTIFICATE-----
diff --git a/t/certs/chain_server.crt b/t/certs/chain_server.crt
@@ -0,0 +1,59 @@
+-----BEGIN CERTIFICATE-----
+MIIDVTCCAj2gAwIBAgIJAP+eH2c2tXhnMA0GCSqGSIb3DQEBCwUAMCQxIjAgBgNV
+BAMMGWNoYWluIHRlc3QgaW50ZXJtZWRpYXRlIDIwIBcNMjYxMDI4MTAwNTM0WhgP
+MjEyNjEwMDQxMDA1MzRaMBsxGTAXBgNVBAMMEGFkbWluLmFwaXNpeC5kZXYwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCeDWeccAggvP1CaEP9X2GJtQJL
+IKozdWmEmu6qXa98aSJMQ/Wps73TsrfH6Ki0KSLQ0XWgpb5geH4a23/537adZVob
+/UUvQHbzOdoMuyh40uYhXXQ14znbmhmKRBbw8Orvbv2oX37dplB4BMlUkduu2D5z
+0ojUyIRtxOgfbLW6cNT6baWj39K07gWhoWZaq3zJvOZtLewfSDBjWwTSsgnS1wqK
+MhdP5ab8R0On5dPMRpV/lHVVTD9e5vs0hv/5cLbujxt7Rbt7ew91SsLX7osDh6kD
+1bPnOKNuApJZV0PdEhF/CAly86h+mLANkC3eXdSwkjocCL3+j/maj2ZZ+XWLAgMB
+AAGjgZAwgY0wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYI
+KwYBBQUHAwEwGwYDVR0RBBQwEoIQYWRtaW4uYXBpc2l4LmRldjAfBgNVHSMEGDAW
+gBStTAeW4Kwh9QmpPRcNCeOOemlUyDAdBgNVHQ4EFgQU4eFiuUwLKF22pRRI6OG8
+xobPSPIwDQYJKoZIhvcNAQELBQADggEBAE14MQx26iIFGvSNQgU/4JKgH1zF4IeF
+6gzzFJCuWrWqA/FZA3EVkTH80I0BY8OuPNOuMMbLXOJIGIhhIVpuNY/X0PF1zbOG
+8HRGjZM0TV0RYhE+yY6e8jkqdX1Z7vjpKbFyg7Og+gBy2okgfBuLZMtsgLIq3AUy
+rR88FCpQghrAPHMCv8xgvyAzfNB0K3ksFtoZckmZLDgHJYhbFSYl8D8CHUrsXtJ6
+FMK3AKGE2A6Dbw/M1Bn9SvM0VcvqRd6A1LZ9P0jSawAxT9yn+juda5R1VrY5vF4f
+i3WQu/L999wySw6MOOBHnbAVsmwlW9b7N26NhHpnLy0w5OnA6Z7tPHY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDLzCCAhegAwIBAgIIfr/Ihc1XqtMwDQYJKoZIhvcNAQELBQAwJDEiMCAGA1UE
+AwwZY2hhaW4gdGVzdCBpbnRlcm1lZGlhdGUgMTAgFw0yNjEwMjgxMDA1MzRaGA8y
+MTI2MTAwNDEwMDUzNFowJDEiMCAGA1UEAwwZY2hhaW4gdGVzdCBpbnRlcm1lZGlh
+dGUgMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI3MAmgNUMfUWetK
+OngY/jTkUFoDgygJQsER23I/I+n/cEB0xA9ee/nW/exVgyiGwDpDZEGdJ55ab4b3
+6G+HuYX8BxaBuOEUi7zeC/GKBzF50/qMVfIOmgUL3F6fFggy6oO89tHdTNAABK9x
+kcLqo326+Q8SGbSr9YGnrblGJ2wGM+0siEZuiPbHqQf6uGR6hMOrid6otgHUH4l7
+8ZxX6GWBz4uCMVqTp3Azn1qpIxePH8+LNALdifHpJu3aVXbZrdWkB2K3pfem8RLw
+UeTGjYXHUJIHajIb76gQGRs9Vk9nVU2mhghd83sB5mpFdhBfRjGTyAdt8rGxkG+C
+tEDFKN0CAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+HQYDVR0OBBYEFK1MB5bgrCH1Cak9Fw0J4456aVTIMB8GA1UdIwQYMBaAFEF2dgNc
+oxWQWie24GufXP2oZrCZMA0GCSqGSIb3DQEBCwUAA4IBAQBUPLBMzI+eJt3g/YK7
+7wpxrxqSLmRXWi3MhnUoIAgwVqEKJXoQkXJN9AbAJqPhEHfT2Vh4rr9Kr88WdEf6
+BI0L2Y3h7ueqWJhLY7Nzf36kpBLkduRCsfQiCq5e2lnIuMtCxyaPO1bKgGSxkwmF
+NPuyb1s616GWTNWplCaNIEfFfzj/f97RFL1KcHkDDVtGp9WUtEnIeZEJ28byyzEs
+M/+qFIR8mFFmWPgWaZFs9aDWX9y+O2+pqzqhKQ+VJZjEINh6jFtGg61deWVhS2us
+u7FtajgvJPkCkJ3PIQFZoV0vyZ19vnEwzpMqItL0rnsR17KQePIoaN8X1t47Spc8
+AKPE
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDJjCCAg6gAwIBAgIJAJ3OIOomSX9hMA0GCSqGSIb3DQEBCwUAMBoxGDAWBgNV
+BAMMD2NoYWluIHRlc3Qgcm9vdDAgFw0yNjEwMjgxMDA1MzNaGA8yMTI2MTAwNDEw
+MDUzM1owJDEiMCAGA1UEAwwZY2hhaW4gdGVzdCBpbnRlcm1lZGlhdGUgMTCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAI899uziWcPXmK517MeXtocmspyZ
+gC+ujJn3r/pvEmoUMiKv7Y1MR9S8dFrF2mS6fDyCE6+rBt3E1+6IQnga5D51rlOa
+z4U4qRCQHDtuWE2Y7VXASdg7+LbJEFoCPXjvgBuR/ZDqonwEfwl14cqtxBUZys+6
++102qnjoS02B4IzbN6ixyoACmJhcq5d7o1bZkwgqg5InF+zptAHLs7V5RrKAu6/g
+02B4BjpsIPKIFlwGQeTPzZD30JcUvvWq79mnmqTebYz3N4jQwnneMJSbAzvcVI3Z
+omBSVyfEcJFFZ0w+wb2wm86+J03zV9nxjPVzzyyVPPFFzfChCBLTOqcXHp0CAwEA
+AaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
+FEF2dgNcoxWQWie24GufXP2oZrCZMB8GA1UdIwQYMBaAFEJKJ40gRX7vk5GQAhks
+zWLA9o+LMA0GCSqGSIb3DQEBCwUAA4IBAQCW36wyL40+yVGyptZlkEcfRwcbzOnO
+/PkR57BwY9uoHXZSgWg2hsJbga90lbPLqI6Ok1mDVSrBi98/0+rxEagw29mm9oys
+KuVPE6II4QOhZMlNYAR3jy0gRiewrOEgEZeLe94IFEkPSNoebxYLaCLzyacc+Lk+
+0FsRTi90AP1oaPA7W9oVM1llTXwrndDh5nVrIajki25JKAO0NlqCDgpl8vJBNmiJ
+Q8kqnQHHwA9OP7m/xKgZ1sTYkQw3YA3vhDqrtEclr7PGUDhfRZyb3sQhMGr6KnnY
+1WcrNwCysZMoRMnej4C9X7pmOau6ShFaAFg2AM9jiKgi9EuQNWQH1HJC
+-----END CERTIFICATE-----
diff --git a/t/certs/chain_server.key b/t/certs/chain_server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCeDWeccAggvP1C
+aEP9X2GJtQJLIKozdWmEmu6qXa98aSJMQ/Wps73TsrfH6Ki0KSLQ0XWgpb5geH4a
+23/537adZVob/UUvQHbzOdoMuyh40uYhXXQ14znbmhmKRBbw8Orvbv2oX37dplB4
+BMlUkduu2D5z0ojUyIRtxOgfbLW6cNT6baWj39K07gWhoWZaq3zJvOZtLewfSDBj
+WwTSsgnS1wqKMhdP5ab8R0On5dPMRpV/lHVVTD9e5vs0hv/5cLbujxt7Rbt7ew91
+SsLX7osDh6kD1bPnOKNuApJZV0PdEhF/CAly86h+mLANkC3eXdSwkjocCL3+j/ma
+j2ZZ+XWLAgMBAAECggEAHpC1EtnPmJUz3R3Q2DUT5c+ti93bTGxOZaiYszW+9C5Y
+xar23US3VzNeuzhRN9Ykt4FqYBDtijaDHKqKS0ZqSHILRRJryMGMv2jWtFOVdhhD
+DPzHtowk6kUY31ZfoWTV6kvqnh8pp6+8LBmw3bv/YgbLvRZgA9ZrVdcYlMsvMcjG
+L/a8djMIgoyyyd0ARcGlKBJ3S/YQp+qRyzRN5c91G0cvMAGacj5kIPOv/ndwWsti
+KdgvqeiKj8OUQS1VFa8Oe4V+CE8JVH1fr/vO+HkjOpxImvJMr85nLAPEy2BNA+Al
+OPGj/BrcDUaDpYq8sCYEMG2OrpEEYMHjaqefsJXVUQKBgQDbS8c+4tS7Mjvzecx/
+gonD5pwRu5sHZTHwjsXK0rQkupOur+D3pXoVCmRjXXF28aBqwzve6HUJIIrL50dH
+5EH/taI/5idwERayna6BHzopm+h0WUOvfrC6Vkx3moO24sIB27pEQhlxa+vrjrGu
+g2XSILIlkz88GohWTUiygWp7RwKBgQC4gYHVOQjbCyzFoY3W6Yt3ARxmW+c7N/tP
+WQElmMnsy757QhUfv+UUKOlcbgQUvVNfbgxd/NqtNWOTwWaJM2/+tu0RmSLylzgf
+pxpb5Lxiny20QfZpruGx3E7KksVSo9aagMlopRmONT5sRBUw90skPqQG4J4kQOYQ
+XVVcI2zNnQKBgQC9m+q9o/DdnpSZczFu+pZVbNp6tqRXo5ancTrxoHcj3rJ8cxPn
+7Ar/kEm2ZIALoOXcCcyFcqZm6t03alSGg4TRLOIJr91fl1bxv0a33CE1AtndZ6UP
+Y1I4+w8Ixu+lvLCUXMDT7fcDy5VjybA1vOTX529A7+zX8fT58b6uoRlJVwKBgAXJ
+EdAkzLFJpWrBCRiPFC90GnbfNN33gGrZiJ6sLtC9BskIpm7rbnx2V/LtBDW+Rgn9
+AmhEEHtT7D5q1xNASKe9BqwBmEXxFfJwI/RztLCG+0DmvJpNwIf6N4JEnelcd9M6
+bJZabvW1l7J/ZAa4CmQljrEkg/DxFAW5V37fIX9FAoGAPRCIDwDQazdxl65fmnJc
+GGH7mm7aWQb5UgMTSACS5NC3TO7G2TrqkI3OZ4J4AWW+sOwxYMQAleMAqILKvAz0
+NBjc/Jqu4a9pbiSDlv18VveNNiNS4oBo81IeOuJZZTmh8K3C1L85zpKvdZhYVTwW
+aRUOeUorHIo+oTUy9E7upyk=
+-----END PRIVATE KEY-----
diff --git a/t/certs/crl_ca.crl b/t/certs/crl_ca.crl
@@ -0,0 +1,11 @@
+-----BEGIN X509 CRL-----
+MIIBiDByAgEBMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC2NybCB0ZXN0IGNh
+Fw0yNjEwMjgwOTIwMzZaGA8yMTI2MTAwNDA5MjAzNlowFTATAgIQARcNMjYxMDI4
+MDkyMDM2WqAPMA0wCwYDVR0UBAQCAhABMA0GCSqGSIb3DQEBCwUAA4IBAQABq2Ui
+90Wk9YxrrdK1HnTeGQwJozR8xvdS1RKTuLDEYeKs4MT4mNy61rqfoPw6U9xnI8At
+fj5MbH+NqHGbb7Ged/DPji9y3FIB0Z2GBm+81pugzDtkzekQHZ8QN3HzhlGN+rZw
+bgpsRpiII1vfUc3NGRA8kEYbAG0QgWNzeb4LB9kuQxmlDBdT4gKy1dn4gLWpRFXQ
+q8NUPZh3m/tO8jdSGCHwxivLaEqRYeW0QJ2AXpU6uMhoD0/ieSw2mvmPDCsDMhsv
+XGDfmvH4Qfv33s1JHzy9olHZpWgjfmWF0Auggwc1cq3pPjU5A+bhzB42b1So3jJU
+GDa6f93QGCZCH038
+-----END X509 CRL-----
diff --git a/t/certs/crl_ca.crt b/t/certs/crl_ca.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIC/jCCAeagAwIBAgIUS9Q6AIR5tfZoO5DvzplICvbEvsUwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLY3JsIHRlc3QgY2EwIBcNMjYxMDI4MDkyMDI3WhgPMjEy
+NjEwMDQwOTIwMjdaMBYxFDASBgNVBAMMC2NybCB0ZXN0IGNhMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs9CNW7eJWC6A+K5xzPan3YKZjCegoPoOCblt
+/pxXfSIt4ykZiniBKqb53B2Xk2LRyzyjmQ+i5lDPuSrlbCm76KFFsz80IUTsHurR
+WE05zwXEkK84cQEOr+2KmN0ZYH3Y4IkaLenWLAWgtDcDuBOFySqntJNLN4VD59JT
+kcnFH9+INvf1zxeGpqJnrLg/JyavQXIdE3PKTuk8pyFoJtjncTytD65QxoOGBfCI
+UWSBaxGZ87czJ6yveI77jXK94DFE8YYqyIjugY1gPgaQhjAsr6EefdtrPBspcoVO
++HOmpID5PoQ87bjCGN8W5lWCC0RQqq/PhdLNO2o58fkjWJmzGwIDAQABo0IwQDAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUXr7N+mjK
+ffW0yu/x/leMZfNa0gQwDQYJKoZIhvcNAQELBQADggEBABG4yNESK5uRnztuIq0Y
++TFeR67+QmOr7uG9afceF68C+J9WXKLpHafKpt6LHJ3boPKfh3zSoOUM2F0hnFmw
+e8v68MnyIBotHltDsp4828zSeAAJ5n9AvVVSAqTD6LlyMiSzxM/UWwNVU/tPOl/5
+6WbDZL3UMkTi/Vt4VCjfUhTA05DBu5MVRbIeQmMx1CpV4UFHeDYO+Cl2MtWbY6sM
+0eEwVX8fxIm2pMb/8XyE3dJj21j7og/OWe1qo1aVM723co0cbGHquZ0SmKtyHg8U
+u+1DaFCUVlo3yUVv66stBThO0CYsTH4roPy3DYrIJKNruWspDycp7sYZJ0BGnpop
+QnE=
+-----END CERTIFICATE-----
diff --git a/t/certs/crl_revoked.crt b/t/certs/crl_revoked.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDQDCCAiigAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLY3Js
+IHRlc3QgY2EwIBcNMjYxMDI4MDkyMDM2WhgPMjEyNjEwMDQwOTIwMzZaMBsxGTAX
+BgNVBAMMEGFkbWluLmFwaXNpeC5kZXYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQDAP1tWh1GxMl1XrthPldA6U6LbHGX5qq5UZ20t1JLrYW9v50cTSW6o
+H4ncgPGRflb5YWmcwbmDTsBZeRAO4miA5Fyp9KB0eAveOT9iK8cjfDIWwEQ5v6nx
+8b6bvEgHjn7W3JYy4ryPDqap/oCZsHw0Sjqr7nUQmR1L7L1wGKCgs1is6FZLs884
+FDwIRziPAnL17Dtyq4xzjuu1p5ouy0lFBns7cn1AacCop8EqgCpms6BR/OKt2zh1
+HlVkQYy/ZtZ2r58ELpc9CA2TBAcUEWWHKylTMTtDeyARQf5+RYBHcTpYw8wduhLA
+s72FGZ4A+YK+NLAk60Vz1jV44p4H9sZLAgMBAAGjgZAwgY0wCQYDVR0TBAIwADAO
+BgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwGwYDVR0RBBQwEoIQ
+YWRtaW4uYXBpc2l4LmRldjAfBgNVHSMEGDAWgBRevs36aMp99bTK7/H+V4xl81rS
+BDAdBgNVHQ4EFgQUHJiX/wzAgCIYD2RPMKcnE8yxZiswDQYJKoZIhvcNAQELBQAD
+ggEBADY8TfO/j+LmKp7Q4ESW+whfxInu3tIyYFyZPJTlWTP+59qMWjeTeyult4XA
+0s7otvjOLoBu7O48qQ2lb448CmkzjIJjo2F8+yHfr/c5FIa7oY1MCiIjuRe5OZBr
+h4BqQCsOcAXzTutO8JTPm+B7NMtynpzoKWKlwpS5U53RJ4iDNDSn/dHF5+b2Bias
+6+vIczru4gxw016ps0ROrOJrurHORuQZe3tBjz3hZFNAIgj3jt5HOiv1fMCrQAUX
+PZPyWG/FSQ4SbM6WXYyEE7qRgyhGW4GlL2fHkjGhkVhXSBQukEljbpPyY/Iqyw6S
+zmeSug9y61+yKR81ULzknlLgGY0=
+-----END CERTIFICATE-----
diff --git a/t/certs/crl_revoked.key b/t/certs/crl_revoked.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDAP1tWh1GxMl1X
+rthPldA6U6LbHGX5qq5UZ20t1JLrYW9v50cTSW6oH4ncgPGRflb5YWmcwbmDTsBZ
+eRAO4miA5Fyp9KB0eAveOT9iK8cjfDIWwEQ5v6nx8b6bvEgHjn7W3JYy4ryPDqap
+/oCZsHw0Sjqr7nUQmR1L7L1wGKCgs1is6FZLs884FDwIRziPAnL17Dtyq4xzjuu1
+p5ouy0lFBns7cn1AacCop8EqgCpms6BR/OKt2zh1HlVkQYy/ZtZ2r58ELpc9CA2T
+BAcUEWWHKylTMTtDeyARQf5+RYBHcTpYw8wduhLAs72FGZ4A+YK+NLAk60Vz1jV4
+4p4H9sZLAgMBAAECggEAA4+o43tyOfQS4pLsktzVlJ8D/0cRZISS4iFgVl7/sbiG
+Ve5U1Lihgh/DcAA7eVR7y/bP/AViqFoHGiEx+PSctvaD+On9JusqXR12XR0ufSvJ
+yb4aBW/VeBPgUgY0117+XoCLj7m/gG7nC3MZcr9gLZ/KYnDyXjJX5pYmFDOAljl0
+C+Nra8AKqc+9Pnbo7yIlwwdNc5qBNZ7RYMCAjqBjV56SbdJR7QmnEI7seWuylafJ
+6YIeE1qFj0SisuSiEyBiJe++CictJntYscR997O6tdxAtdzDGWjGOXSCIpPfqMW2
+k7S4OCUD3abEh1791HIIJZAkI3m5ty4sw8rnPXW0cQKBgQDlKtF2oSNC6Wf31P+8
+F0baaJJ/Ytb0OodEx/b1iQ7ZiLxtdNJd1OtlSm+e9G121U7zI7rgTkJ6InPERRoM
+t7pWiYucEqlbh0Uqheo+ebeiQ+PNaAu7Zns5BhyXvVJ3HNZ8qL49ExVu5vxd8QZO
+XQm2UjGDHU35uc/FsDedkkLfLQKBgQDWweK5CmoU++z+JcA7gnhZdsYFrSap6ORv
+xTpHNBZGZx1Wp64X9sI8iT1mCizZPWMUqCLjRpZxMAq7ZU4YwLlOF8KX14mY/O6A
+IKwvd9TTYC0XJk1c0nuNKcdwOZEkBZ+Ec9w+TkiyeJTAjQHEKTzabMuRfHeCXNei
+ZniYojVmVwKBgQCSabPf1f2gT11EgspM0pZLDkqipnRtH0OzFwraPpHFO84fJGcO
+2ez3DwKXjNSu+oNxZh+MFZP1UjOibv/AplWf2krfETEwsBDppRtOhRdkzXkqj9IH
+DeemPBhifevE/CCxDmJUxO+JpnwQTOBZiqmc2ZCWk09xQFzVkctGmd6tlQKBgDlC
+pPL1hedmbIAvDJxRY0lnU9E7o611/UKX8bv+dVn8MGRkfRTCpHODnC1S1TZvGbXu
+Rq8WqRIw3wusLTCIYmAiEa5ut69k8SqUi5R0fPiHEj6z5bi0HmE7HIQdtUdHgIrO
+YZDzSorbf73/WtM0s5cBnx2BdFP78TrJ26nGxjotAoGBAL6MUxmJkqa8RTM7jBlH
+lyNqA4wgok5RisdAqY6IUBQnR393ESadZjrBD5bLCR5dJ+PfRbCjm3aGdjRytpC4
+c5BJ17YvWx7yKKfO5bVAYMAP7XzVLbpBd5oJN/3waIqPYwBEqmZGsuibf3+KQ4Ik
+BE3bCv0ob+7AIuh0NwQhUN/n
+-----END PRIVATE KEY-----
diff --git a/t/certs/crl_server.crt b/t/certs/crl_server.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDQDCCAiigAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLY3Js
+IHRlc3QgY2EwIBcNMjYxMDI4MDkyMDI3WhgPMjEyNjEwMDQwOTIwMjdaMBsxGTAX
+BgNVBAMMEGFkbWluLmFwaXNpeC5kZXYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQDKIgV2jw12zz4VYGrQX263JytLVC5DjXw7JtTE2KOfMKzXskCRQ5Do
+naQuoxJmzQ+THRgxp3IvV9/HLmSjqtkdA+FNJY8uo/O4en/jCBQPVZpEkRcQ5cG9
+AMXQK4qZSW3UPffDJw/canDZBMbyj0u8Ma3dzbcBu1jWBIsTFJ0FnRT2QQ8r9B8I
+BYcCskYo3jsFZXnjJqULckQ2zKY+M9sROp5pLPBwuWBOjBlI8QLyWgjEbk1Jmk24
+m6IzWyFUyYFOAGA2zjtGWZekHcrnfj3RaQhmRg+oEIZO+KHwp2K6qJB4s5R+XYf3
+G33mpXxFfPkFY9ha/05Y+KTKKDY2QtL3AgMBAAGjgZAwgY0wCQYDVR0TBAIwADAO
+BgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwGwYDVR0RBBQwEoIQ
+YWRtaW4uYXBpc2l4LmRldjAfBgNVHSMEGDAWgBRevs36aMp99bTK7/H+V4xl81rS
+BDAdBgNVHQ4EFgQU5xSKo8tPSDKyVgSp/7V0aKYYil8wDQYJKoZIhvcNAQELBQAD
+ggEBACjL7rqFYwohXoX7wc3MKXGmK6X18JKZJ1xgfXmlWQlgCE8M4py0gdQ1aNrB
+QwY9IFxCa/vWFDnfdcS6NmsA/GIufdEjN+4M7OklN4/IgHlYJFXKnlHu6OUNqj/N
+FXI0sjCqIigWSTy2fheW3pAxfFONPL/T0Sg1SWJxCGCg7wUrqbgqIjIbqulPqlZi
+N/diQD07sFaL0Ofp0o+GIOAxmfSa1SCtmyTUHvkJ+0QveKd9yko3YQdKpVkDUWes
+12MSh2QHWC+i7i0GrVvv+bDNBR1aGaegwQG9US8jkTzAMSx5JsBm12Q5HpEgbBKG
+wOIJFK+w5LK7G1GrrWwx6Z1R71Q=
+-----END CERTIFICATE-----
diff --git a/t/certs/crl_server.key b/t/certs/crl_server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDKIgV2jw12zz4V
+YGrQX263JytLVC5DjXw7JtTE2KOfMKzXskCRQ5DonaQuoxJmzQ+THRgxp3IvV9/H
+LmSjqtkdA+FNJY8uo/O4en/jCBQPVZpEkRcQ5cG9AMXQK4qZSW3UPffDJw/canDZ
+BMbyj0u8Ma3dzbcBu1jWBIsTFJ0FnRT2QQ8r9B8IBYcCskYo3jsFZXnjJqULckQ2
+zKY+M9sROp5pLPBwuWBOjBlI8QLyWgjEbk1Jmk24m6IzWyFUyYFOAGA2zjtGWZek
+Hcrnfj3RaQhmRg+oEIZO+KHwp2K6qJB4s5R+XYf3G33mpXxFfPkFY9ha/05Y+KTK
+KDY2QtL3AgMBAAECggEAAiR816uJ16nispSkYokLF2M8O5Qs2V0f5VCdY2jDHeYv
+hCnI3Wv7QTv1MuQE8eoChutWslAKuc29+tKBu+piWsMLxFGS7vT17w1SsF60N7q5
+4+LV0mwHswUrE5sii6ASS0miMq4F+67Ke20S3sdTZNnx9IPrCK2qXLpiRFWCRJOc
+2RHGiP30jnEo0jfyPF3E55+fvooVeWigPisONqYo1fVn6Z8sfLpm8oEYatKyhKqC
+asoQmehFiiP25PU9cd1HDHb5dywNDtwKUWoG55douFrYTZpXy6b3ELxlAnQ0hTl7
+VnIm9DOmSpaKwkHBj21/ARRLlY0Mu5usBeDhPD4noQKBgQDoxFlRlUTwWoPsgJ50
+GqOmLRQvMZ2dgr+6VsH19HNivKsqSnHFUGT8Z3qA9xnbTs8/tO6AYh9mnHxVli3y
+yKjc+GBLis7Q3Wd3rzcYFnD06c4INWtUIFrV1Gq39sQ62BQDKKOspSPYm6xGKNDL
+fEQjp1B9Eu/TlkJ45PBoYwIyAwKBgQDeTulcQvjOtzFKpSw4op5Z3A23eFrWF+SK
+Uc4cQEdLFNb+jSIRnI/2+jdWBApA7tVRrBD6Hq6zHoQjfa4EIP1rL4lCEaRtwnXe
+EcOxupRLctJIQZF+2T3HMQyInomdSQdS3gIffN9WlCAadOtcU6SHRkHKob8JgTYP
+zsYiatEi/QKBgA6Ik/sgEtnfDPWrYjlloGozzlrUAj9fdpEv8ZRl2v6DQTy2wTvM
+tUF9RIzg4OBsn0wfA/VIKyXBB5JgeiX6mXCSoZCV7ivkZx119z6tyAfCwXaJv1XV
+X1aSmMc7xSzXaQh5dR7GgOJ5ddw7mC3caHTBcakdkZPogeYChXA/Hlf5AoGAGs0O
+qzXTwzAovCQPocBRMOorqSvUX60/u0FDhPpm3fFkPgoLym3CmXbvBuqzxcJFa3RA
+E7dxPlz2d0Tmns7PXoW7mYCA/06LYTtpCVtCF5p/KYDmJpHQNdx+81WRp6mvPVlQ
+jjVCw7BV8nqYCWh4FGru8ZvwaRfvyZYXIv0Xu40CgYAVdsKs6xAhC6TUltlyoNli
+J1Yi5PalFQK5YY5S1AeHKVVX29k7kS1M6IXgWQ7nUEuAvz5Txcs7jOvTaaOYQI9F
+ltbhQIlIWmYWLGEuUS4uGYP8evyOJK8xhDHjn+5AjccBEheCeB6FR+O38xAX5NPP
+bCqKAFUIdaGndXwc1rjiRA==
+-----END PRIVATE KEY-----
-Original file line number
+Diff line change
@@ Expand Up @@
     Or you can reference SSL object by `tls.client_cert_id` to set SSL cert and key. The SSL object can be referenced only if the `type` field is `client`, otherwise the request will be rejected by APISIX. In addition, only `cert` and `key` will be used in the SSL object.
-    To verify the certificate presented by the Upstream, set `tls.verify` to `true`. Leaving it unset keeps the behaviour configured in nginx, which is off unless `proxy_ssl_verify` is turned on. The certificate is checked against the CA certificates in `tls.ca_certs`, or against `ssl_trusted_certificate` from `config.yaml` when `tls.ca_certs` is not set:
+    To verify the certificate presented by the Upstream, set `tls.verify` to `true`. Leaving it unset keeps the behaviour configured in nginx, which is off unless `proxy_ssl_verify` is turned on. The certificate is checked against the CA certificates in `tls.ca_certs`, or against `ssl_trusted_certificate` from `config.yaml` when `tls.ca_certs` is not set. In the latter case, a CRL configured in nginx with `proxy_ssl_crl` (`grpc_ssl_crl` for gRPC) is also checked:
     ```json
     {
@@ Expand Down @@