X509_PURPOSE_CRL_SIGN
{X509_PURPOSE_CRL_SIGN, X509_TRUST_COMPAT, 0, check_purpose_crl_sign, "CRL signing", "crlsign", NULL},
purpose = X509_PURPOSE_CRL_SIGN;