ProximityCrlRevocationEvaluator

Reader-certificate CRL evaluator for ProximityReaderRevocationPolicy.Check.

issuerCertificatesDerBase64Url supplies the public issuer certificates needed to follow the authenticated reader chain. They are lookup material and do not establish trust. With authority checking selected via ProximityCrlScope.ReaderCertificateAndIssuingAuthorities, provide the path through its terminal self-signed authority; each checked certificate must have an applicable HTTP(S) CRL distribution point.

ProximityCrlScope.ValidatedPath requires ProximityConfiguredReaderTrustEvaluator, which supplies the exact validated path and selected anchor. The anchor itself is excluded from that scope. Raw-evidence calls for this scope return indeterminate and perform no fetch.

The SDK verifies complete direct v2 CRLs, including CA revocation, with ECDSA/RSA PKCS#1 and SHA-256/384/512. Unsupported CRL forms, absent status, invalid signatures and stale responses remain indeterminate. A verified revocation takes precedence over an unavailable status elsewhere in the selected chain. The application continues to own fetching and certificate-path trust.