diff --git a/crl/checker/checker.go b/crl/checker/checker.go index 9bceb308f..08a1add8f 100644 --- a/crl/checker/checker.go +++ b/crl/checker/checker.go @@ -59,11 +59,11 @@ func Diff(old, new *x509.RevocationList) (*diffResult, error) { return nil, fmt.Errorf("CRLs were not issued by same issuer") } - if !old.ThisUpdate.Before(new.ThisUpdate) { + if old.Number.Cmp(new.Number) >= 0 { return nil, fmt.Errorf("old CRL does not precede new CRL") } - if old.Number.Cmp(new.Number) >= 0 { + if new.ThisUpdate.Before(old.ThisUpdate) { return nil, fmt.Errorf("old CRL does not precede new CRL") }