-----BEGIN X509 CRL-----
MIIBrzCBmAIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1jbHVzdGVyLmxv
Y2FsFw0yMzA3MDUxODA2MzBaFw0zMzA3MDIxODA2MzBaMCcwJQIUIf2Vv9QwxTJg
EJObGbJvHMthI2cXDTIzMDcwNTE4MDYzMFqgIzAhMB8GA1UdIwQYMBaAFPJgj82D
0mj8lifyRv1p/Ov4gUqlMA0GCSqGSIb3DQEBCwUAA4IBAQCjJAW4cTwqM7SoLa7F
w9TB2CMdKVx4GGKouGRC1FLFRQMx/8rCOXRtxw8CriLlyTqhkMHwt9Y+FCvBj0F6
ifski2z5XxCjdAxiVAuQM23cYgTm47jeiRvfGNMVkgdJ+neo+vO5lLoIaOh1W7H/

-----BEGIN X509 CRL-----
MIIBrzCBmAIBATANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1jbHVzdGVyLmxv
Y2FsFw0yMzA3MDUxODA3MzVaFw0zMzA3MDIxODA3MzVaMCcwJQIURRGeazmADQ30
imTNVdo7eWHGYzcXDTIzMDcwNTE4MDczNVqgIzAhMB8GA1UdIwQYMBaAFPJgj82D
0mj8lifyRv1p/Ov4gUqlMA0GCSqGSIb3DQEBCwUAA4IBAQAkZdoqv7E1kQ1/lqdx
2qSnR6WQFNCrdiH5WCy09cEEVxvmPVByTUaZ8cL7V529iGBYDgBj1ZTw9cogWige
Jgbgmap7uKRABtNpncjNFTwTgym40YR86XWVXt9vQpXghCkvdGRa90DIMMCZpiXN

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
  - |
    **Added** Certificate Revocation List(CRL) support for peer certificate validation based on file paths specified in 

	}, corev1.SecretTypeTLS)
	tlsMtlsCertSplitCaWithCrl = makeSecret("tls-mtls-split-crl-cacert", map[string]string{
		TLSSecretCaCert: "tls-mtls-split-ca", TLSSecretCrl: "tls-mtls-split-crl",
	}, corev1.SecretTypeTLS)
	tlsMtlsCertSplitWithCrl = makeSecret("tls-mtls-split-crl", map[string]string{
		TLSSecretCert: "tls-mtls-split-crl-cert", TLSSecretKey: "tls-mtls-split-crl-key",
	}, corev1.SecretTypeTLS)

# revoke one of the server certificates for CRL testing purpose
openssl ca -config "${WD}/crl.conf" -revoke "${WD}/dns/cert-chain.pem"
openssl ca -gencrl -out "${WD}/ca.crl" -config "${WD}/crl.conf"

# remove the database entry for the previous revoked certificate, so that we can generate a new dummy CRL entry for an unused server cert,
# to be used for integration tests

				CaCert:      file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/root-cert.pem")),
				Crl:         file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/ca.crl")),
			}, false, apps.Ns2.Namespace.Name())

			// Create a valid kubernetes secret to provision key/cert for sidecar, configured with dummy CRL
			ingressutil.CreateIngressKubeSecretInNamespace(t, credWithDummyCRL, ingressutil.Mtls, ingressutil.IngressCredential{

	GenericScrtKey = "key"
	// The ID/name for the CA certificate in kubernetes generic secret.
	GenericScrtCaCert = "cacert"
	// The ID/name for the CRL in kubernetes generic secret.
	GenericScrtCRL = "crl"

	// The ID/name for the certificate chain in kubernetes tls secret.
	TLSSecretCert = "tls.crt"
	// The ID/name for the k8sKey in kubernetes tls secret.
	TLSSecretKey = "tls.key"

# crlnumber must also be commented out to leave a V1 CRL.
crl_extensions = crl_ext

default_md      = sha256                # use SHA-256 by default
default_crl_days= 3650                  # how long before next CRL

[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
authorityKeyIdentifier=keyid:always
[req]
req_extensions = v3_req

				{
					name:       "mtls ingress gateway without CRL-client B",
					secretName: "testmtlsgateway-secret-without-crl-b",
					ingressGatewayCredential: ingressutil.IngressCredential{
						PrivateKey:  ingressutil.TLSServerKeyB,
						Certificate: ingressutil.TLSServerCertB,
						CaCert:      ingressutil.CaCertB,
					},
					hostName: "testmtlsgateway-crl.example.com",

	// the CRL. It is used when creating a CRL and also populated when parsing a
	// CRL. When creating a CRL, it may be empty or nil, in which case the
	// revokedCertificates ASN.1 sequence will be omitted from the CRL entirely.
	RevokedCertificateEntries []RevocationListEntry

	// RevokedCertificates is used to populate the revokedCertificates