Questions tagged [crl]

A Certificate Revocation List (CRL) is a blacklist of revoked or compromised serial numbers of certificates. As a serial number has no direct relationship to a certificate and can be fabricated in a compromised CA, it is considered a weak blacklist.

Filter by
Sorted by
Tagged with
1 vote
0 answers
204 views

Windows CA Publishing Expired Certs in CRL When not configured to do so

I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration: Server 2012 R2 ...
Helstrom's user avatar
1 vote
1 answer
796 views

What determines the CRL expiration date and validity in PKI?

I'm working with Microsoft's Public Key Infrastructure (PKI) and I'm interested to know more about how the expiration date of a CRL is determined and how it can be adjusted in a Microsoft PKI ...
kambm's user avatar
  • 41
0 votes
0 answers
279 views

Are crl updated automatically to user after a certificate is being revoke?

I'm clueless on how does this CRL/OCSP works. We do have a local enterprise CA, and was set on the CRL publication interval to 8 days. As what was told, when the certificate is revoked, it does not ...
boxi's user avatar
  • 1
1 vote
0 answers
391 views

Need help figure out why I can logon to Windows with a revoked smartcard certificate

I am adding smart card login to our domain and have got almost everything working properly except that when I revoke the certificate on our Enterprise CA I can still log into computers. I have checked ...
Andy Haer's user avatar
0 votes
0 answers
145 views

Certificate revocation on IIS (CRL and OCSP)

I need to figure out how certificate revocation works on IIS. Certificate we are working with contains both url to CRL and OCSP. As I understand by default IIS uses CRL to verify if certificate is ...
Ash's user avatar
  • 101
1 vote
2 answers
500 views

What is the best practice to handle expiring S/MIME mail certificates

where can I find info regarding the proper way to handle expiring mail certificates? Here's the problem: our certificates for digitally signing mails expire after a year. If, a week before expiry, I ...
Jürgen Depicker's user avatar
0 votes
1 answer
746 views

Can a server certificate from a CA not have CRL URLs?

I'm trying create a validation for server certificates and one of the things I need to do is to check if the certificate is revoked, but the server certificates from a specific server seems to not ...
nicolasassi's user avatar
-1 votes
1 answer
1k views

CertUtil: The directory service encountered an unknown failure. 0x800720ef (WIN32: 8431 ERROR_DS_UNKNOWN_ERROR)

I am trying to publish revoked certificates and I am getting an unknown failure when using the Certificate Authority console: The Application Log in the Event Viewer: It says: Active Directory ...
thotheolh's user avatar
4 votes
1 answer
1k views

Revoked certificate is still valid by Google Chrome and Microsoft Edge

I have generated Self-Signed Certificate, Root-CA Signed by Root-CA Then, Intermediate-CA Signed by Root-CA and Server Signed by Intermediate-CA The certificates as given below: Root-CA -> ...
soup's user avatar
  • 76
0 votes
1 answer
3k views

OpenVPN issue verifying CRL

With an OpenVPN/EasyRSA 3 setup (split machines for CA and VPN entry point), I'm facing the issue that whatever CRL I generate, OpenVPN seemingly cannot handle it. Setup Overview: Things That Go Well ...
jbndlr's user avatar
  • 101
4 votes
1 answer
11k views

Update CRL with OpenVPN server for longer expiration?

If the error "VERIFY ERROR: depth=0, error=CRL has expired" is received when a client attempts to connect to the OpenVPN server, it can be fixed as follows: cd /etc/openvpn/easy-rsa easyrsa ...
AlphaCentauri's user avatar
1 vote
2 answers
1k views

How to Delete CRL Files in Local Cert Store

I need to import CRL files to a Bastion server that is not part of my environments domain. The CRL files are updated every few days so a new copy needs to be imported to the local cert store on the ...
jrd1989's user avatar
  • 688
0 votes
1 answer
3k views

Domain Member Servers - Accessing Certificate Revocation List (CRL)

In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
jrd1989's user avatar
  • 688
0 votes
1 answer
246 views

How does OCSP handle deleted certificates?

We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
user2140583's user avatar
1 vote
0 answers
794 views

Revoked certificate not getting into Microsoft CA CRL

I have a CA and an Active Directory + ADFS instances set up on a Windows Server 2016 machine. I issued a client certificate for one of the users (for smart card logon) and then revoked it. However, I'...
Max's user avatar
  • 11
0 votes
1 answer
1k views

Ldap service not running on Windows Server 2019

I have 2 windows server 2019. e.g. server1 and server2. server1 is the domain controller. server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS. server2 is connected to that domain ...
Ghansham's user avatar
  • 101
1 vote
1 answer
2k views

CRL distribution point with multiple names

I'd like to create a certificate with CRL discribution point, which contains multiple URLs (poiting to the same CRL, according to RFC 5280): When OpenSSL parses such certificate, it shows something ...
Laney's user avatar
  • 113
2 votes
0 answers
2k views

NGINX Client Certificate with Indirect CRL

I'm trying to implement mTLS using Nginx SSL Module. Everything works fine until I give Nginx CRL files concatenated in PEM format because one of the CRL is an Indirect CRL. The chain for a leaf ...
Romain V...'s user avatar
0 votes
1 answer
773 views

number of crl certificate(s) or pem certificate(s) present in p7s file

Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file? I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
csavvy's user avatar
  • 135
3 votes
1 answer
5k views

Check SSL certificate against CRL when an intermediate CA is in the way

I am trying to understand how to check an SSL certificate, taking into account any relevant published CRL when the certificate chain is the following: Root CA (with no CRL distribution points) ...
mimo's user avatar
  • 283
1 vote
1 answer
1k views

OpenSSL invalid revocation date / update CRL?

I have an index.txt file where I changed the value of a certificate - whose certificate file I do not have - from V to R to revoke it. The index.txt looks as follows exemplarily: V 220303095424Z ...
Ferit's user avatar
  • 111
5 votes
3 answers
7k views

openvpn: crl has expired?

We have an OpenVPN in our aws setup which was set up by a client and now they are not able to connect to open vpn say "crl has expired" . We are trying to regenerate the crl but to do that we need to ...
Ganesh's user avatar
  • 51
2 votes
1 answer
7k views

How to verify Certificate Revocation List(s) against multiple certification paths

In a recent question, I outlined the steps for verifying a wildcard SSL certificate for connecting to PostgreSQL from a remote client (using the same wildcard certificate I use for my web server). ...
Parker's user avatar
  • 783
0 votes
0 answers
103 views

How to delay CRL Renewal

I have a 3 Tier PKI and I have issued 90,000+ certificates. Within 2 days Root and Policy CA CRL is getting expired and I can't renew the Root and Policy CA CRL before 2 months so what is the best ...
user avatar
4 votes
1 answer
7k views

OpenVPN revoke user - CRL verify issues

I have configured my OpenVPN and it is working properly so far. Lately I had to revoke one certificate and after using easy-rsa revoke-full, I saw that in index.txt that specific user has been ...
dovla110010101's user avatar
1 vote
0 answers
3k views

How does certutil determine that a cert is revoked

I'm testing that an x509 certificate can be correctly determined to be revoked. I'm taking the cert from https://revoked.badssl.com and verifying it via certutil. When my system is online, it seems to ...
Stealth Rabbi's user avatar
1 vote
1 answer
6k views

CRL revocation check failed

Issue with crl revocation check. I can telnet target server on port 80. I can download crl with internet explorer. But when i launch certutil : C:\Users\Administrateur\Desktop>certutil -urlfetch -...
Alex Lum's user avatar
  • 165
0 votes
0 answers
2k views

openssl ca -gencrl is not working at all

Out of the blue, all clients cannot connect because the crl has expired. I am unable to generate a new crl. I currently have OpenVPN configured to ignore it for the time being because clients must be ...
ts90's user avatar
  • 3
1 vote
0 answers
750 views

CRL Checking and Proxy Server Authentication

We have an issue with our corporate Windows 10 clients checking Certificate Revocation Lists. When accessing websites or logging into apps etc we are seeing the popup message "Revocation Information ...
Chris Edgington's user avatar
3 votes
1 answer
1k views

OpenVPN service, run as root:root instead of nobody:nogroup?

This was moved from NetworkEngineering. I used this DigitalOcean guide (hereafter "guide") to set up an OpenVPN service (v2.3.10, OpenSSL 1.0.2g) several months ago. It's worked flawlessly, and it's ...
user38537's user avatar
  • 293
2 votes
0 answers
761 views

Keeping revocation lists up to date on Debian

I am using Debian Linux on several machines with different services (Apache, Freeradius, etc...) together with a Windows Server 2008R2 CA. I install the CA certificate by downloading it to /usr/local/...
terminal's user avatar
4 votes
0 answers
6k views

Active Directory Certificate Services cannot publish revocation list after renewal with new private Key

In summary: I had a working offline root CA and an AD integrated CA working fine I renewed the certificate with the same private key and all was good I then renewed the certificate with a new ...
Ross's user avatar
  • 133
6 votes
0 answers
37k views

The revocation function was unable to check revocation because the revocation server was offline

I have a chain of certificates: MYROOTCERT -> MYCHILDCERT. The MYCHILDCERT certificate has a CRL distribution point extension: [1]CRL Distribution Point Distribution Point Name: Full ...
username's user avatar
  • 251
3 votes
1 answer
3k views

How can I make OpenVPN use my CA's CRL Distribution Points when verifying certificates?

I have an existing PKI into which I am trying to integrate an OpenVPN server. I have included CRL Distribution Points into each CA certificate in my chain and I publish the CRLs at a location that is ...
succulent_headcrab's user avatar
6 votes
1 answer
14k views

OpenSSL error while loading CRLnumber

I am unable to generate a CRL. I am probably missing something in the configuration file. The error I get is "openssl error while loading crl number." Crl config section: [ CA_default ] # ...
Moutabreath's user avatar
2 votes
1 answer
2k views

Updating IIS' default CRL (Certificate Revocation List)

I'm in the process of creating a (IIS 8.5) web server which will require client authentication. Client authentication will be carried out using client certificates which will be issued by a third ...
Mackolicious's user avatar
1 vote
1 answer
2k views

RabbitMQ CRL Configuration

I've been trying to find available options for configuring CRL checking within RabbitMQ. RabbitMQ in turn seems to rely on Erlang's SSL library. Unfortunately, knowing very little about Erlang, so it ...
J Trana's user avatar
  • 113
1 vote
1 answer
3k views

wininet 12057 error contacting crl server

My employer's client side application is failing when initiating ssl connection. It uses wininet and it fails on error 12057, certification revocation server is not available. Although crl url ...
Jan Bohac's user avatar
4 votes
1 answer
12k views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
manatails's user avatar
  • 126
2 votes
1 answer
3k views

Revoke multiple client certs signed by one CA: only the first one got denied?

OS: Ubuntu 12.04 OpenVPN version: 2.2.1-8 Setup: one CA cert, one server cert, multiple client certs Server config: port 1194 proto udp dev tun keepalive 10 120 comp-lzo user nobody group nogroup ...
quanta's user avatar
  • 51.8k
1 vote
1 answer
654 views

How to maintain revokation list for client certificates

I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates. I used to issue client certificates using Certificate Authority MMC snap-in. Since the ...
H. den Breejen's user avatar
3 votes
1 answer
11k views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
0xFE's user avatar
  • 201
28 votes
4 answers
49k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
sridhar pandurangiah's user avatar
7 votes
2 answers
13k views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
ErebusBat's user avatar
  • 935
12 votes
1 answer
1k views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
test's user avatar
  • 317
2 votes
1 answer
5k views

Windows 2012 SSTP The revocation function was unable to check revocation because the revocation server was offline

In order to get rid of "Error 0×80092013: The revocation function was unable to check revocation because the revocation server was offline" you have to install base/delta CRLs on the client you want ...
Theveloper's user avatar
3 votes
1 answer
6k views

Microsoft CRL URL's

We have a number of Exchange servers without access to the internet. When updating Exchange, the fact that all .NET assemblies are signed means the installer needs to check Microsoft's CRL during the ...
visualtrey's user avatar
3 votes
0 answers
2k views

The revocation function was unable to check revocation for the certificate

I need to pass IIS certificate authentication on Windows Server 2012. The root cert haven't got any revocation lists but I'm getting exception: The revocation function was unable to check ...
Denis Agarev's user avatar
3 votes
4 answers
6k views

Can I find out what certificate revocation server an application is contacting?

I'm trying to install an application on a machine running Windows XP Pro. There are two different servers being contacted, both using the same wildcard certificate (GoDaddy). One via https, one ...
Joshua Evensen's user avatar
7 votes
2 answers
10k views

nginx proxy + ssl +clr "400 bad request" error

Here's the situation - there's a trasnparent nginx proxy that handles SSL certificates and does it well until we decide to add a revocation list management, required for security reasons. This is when ...
Pavel Potatis's user avatar