Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am installing a .crl in my apache config. It looks like this:

VirtualHost default

DocumentRoot "web" ServerName

SSLEngine on

SSLCertificateFile "cert.crt" SSLCertificateKeyFile "key.key" SSLCertificateChainFile ""

SSLProtocol -all +SSLv3 SSLCipherSuite SSLv3:+HIGH:+MEDIUM


Order deny,allow Allow from all

SSLCACertificateFile "ClientRootCert.crt"

SSLVerifyClient require SSLVerifyDepth 3

SSLCARevocationFile "CRLList.crl"



When Apache is started, I get the error:

SSLCARevocationFile not allowed here

When I place SSLCARevocationFile above the Directory tag, Apache starts, but all client certs are rejected with the message:

ssl_error_expired_cert_alert (both revoked and active certs)

How to solve this?

share|improve this question

I think you have already found the answer but I may help someone else. I have had the same error because I generated my crl with this parameter : "crl_hours 1". 1 hour after the crl creation, the error appears.

If you didn't use this parameter, check the "default_crl_days" of your "openssl.conf" and compare it to the date of last update of the crl.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.