it doesn't look like you can find it by fuzzing x509 cert parsing alone, only in certain combinations like by checking a cert against a CRL list. If you create

it doesn't look like you can find it by fuzzing x509 cert parsing alone, only in certain combinations like by checking a cert against a CRL list. If you created a combined X.509 + CRL parser fuzzer you might have found it. Probably nobody has done that.