I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this:

  +----- AdminUserCA
  +----- EmployeeCA
  +----- ClientCA

I have authentication working with the following config:

server {
  listen     ;
  server_name          www.acme.corp;
  ssl                  on;
  ssl_certificate      /data/src/easy-rsa/bundles/www.acme.corp_bundle.crt;
  ssl_certificate_key  /data/src/easy-rsa/whfWebCA/pki/private/www.acme.corp.key;
  add_header           Strict-Transport-Security "max-age=315360000; includeSubdomains";
  ssl_protocols        SSLv3 TLSv1;
  ssl_prefer_server_ciphers on;
  ssl_verify_client optional;
  ssl_client_certificate /data/src/easy-rsa/bundles/client_auth_ca_chain.crt;
  ssl_verify_depth 2;
  ssl_crl /data/src/easy-rsa/bundles/crls/all.pem;


The problem is with the CRL checking. CRLs are signed by the issuing CA therefore they can not be appened together like intermediate certificate+root certificates.

So a user's certificate will be issued by the given intermediate CA depending on their user type. The problem is I really need to check four CRL lists to be effective. The nginx ssl_crl only supports a single file.

So my question is: Is it possible to have nginx correctly check for a client certificate revokation in this setup without having to do the check in my application?

2 Answers 2


Yes, it is possible. Just concatenate multiple PEM-encoded CRLs into a single file specified in the ssl_crl directive.

(A question in nginx mailing list referenced this question. Posting the answer here as well.)

  • I tried this and it did not work. Is there a specific process or version of nginx for this to function correctly?
    – ErebusBat
    Apr 23, 2014 at 2:33
  • Any version with ssl_crl will do (0.8.7+), it's handled within OpenSSL library. If it "did not work", please define "did not work". May 8, 2014 at 18:44

You have to concatenate all the CRL in chain: Root CA and Intermediate CAs.

Using openssl crl -in crl_list.crl -noout -text only read the first crl, but nginx reads them correctly and validate the user certificate.

Inspired by: https://www.ruby-forum.com/topic/6874370

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.