Questions tagged [crl]

A Certificate Revocation List (CRL) is a blacklist of revoked or compromised serial numbers of certificates. As a serial number has no direct relationship to a certificate and can be fabricated in a compromised CA, it is considered a weak blacklist.

Filter by
Sorted by
Tagged with
1 vote
1 answer
22 views

How to Delete CRL Files in Local Cert Store

I need to import CRL files to a Bastion server that is not part of my environments domain. The CRL files are updated every few days so a new copy needs to be imported to the local cert store on the ...
user avatar
  • 588
0 votes
1 answer
83 views

Domain Member Servers - Accessing Certificate Revocation List (CRL)

In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
user avatar
  • 588
0 votes
1 answer
33 views

How does OCSP handle deleted certificates?

We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
user avatar
0 votes
0 answers
81 views

Configure Apache Server to Fetch and Cache CRL from CRL Distribution Point, Based on Client CRLDP extension

I have an Apache server with mod_ssl loaded. My server is configured to verify client certificates. The client certificates are issued by an internal CA. Client certificates contain the "CRL ...
user avatar
  • 1
0 votes
0 answers
110 views

How to get CRL IP address during TLS handshake in air gap environment

Is there any way how to get the IP address of CRL during the TLS handshake in air gap env? Example: Do a simple curl request over HTTPS against app.contoso.com: curl -v https://app.contoso.com ...
user avatar
  • 301
0 votes
0 answers
28 views

haroxy client certificat pb

I am using client certificat with haproxy (configred with ca file and crl-file ) I am seeing this error in the firefox: SSL peer had some unspecified issue with the certificate it received I am ...
user avatar
  • 101
0 votes
0 answers
53 views

CRL has spaces and cannot publish to the directories

Our Root cert has spaces in its name. (that was an obviously bad idea but it is what we have) I am having issues publishing it now. I have tried editing the registry using %20 , I have tried ...
user avatar
  • 1
0 votes
0 answers
104 views

Revoked certificate not getting into Microsoft CA CRL

I have a CA and an Active Directory + ADFS instances set up on a Windows Server 2016 machine. I issued a client certificate for one of the users (for smart card logon) and then revoked it. However, I'...
user avatar
  • 1
0 votes
1 answer
198 views

Ldap service not running on Windows Server 2019

I have 2 windows server 2019. e.g. server1 and server2. server1 is the domain controller. server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS. server2 is connected to that domain ...
user avatar
  • 101
0 votes
0 answers
56 views

Will NGINX break any active connection when I revoke a specific client certificate with CRL?

Let's assume I have a client (e.g. IOT1) connecting to MQTT broker behind NGINX instance (terminating TLS is nginx's job) and I want to revoke that specific (IOT1) client, but what will happen with ...
user avatar
  • 1
1 vote
1 answer
409 views

CRL distribution point with multiple names

I'd like to create a certificate with CRL discribution point, which contains multiple URLs (poiting to the same CRL, according to RFC 5280): When OpenSSL parses such certificate, it shows something ...
user avatar
  • 113
0 votes
0 answers
112 views

Automatically updating the CRL for pfSense

I want to be able to automatically update the certificate revocation list on a virtual pfSense server running OpenVPN. I don't want the certificate authority to be on the same vpn server, but if ...
user avatar
  • 365
2 votes
0 answers
697 views

NGINX Client Certificate with Indirect CRL

I'm trying to implement mTLS using Nginx SSL Module. Everything works fine until I give Nginx CRL files concatenated in PEM format because one of the CRL is an Indirect CRL. The chain for a leaf ...
user avatar
0 votes
1 answer
248 views

number of crl certificate(s) or pem certificate(s) present in p7s file

Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file? I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
user avatar
  • 115
3 votes
1 answer
2k views

Check SSL certificate against CRL when an intermediate CA is in the way

I am trying to understand how to check an SSL certificate, taking into account any relevant published CRL when the certificate chain is the following: Root CA (with no CRL distribution points) ...
user avatar
  • 253
1 vote
1 answer
548 views

OpenSSL invalid revocation date / update CRL?

I have an index.txt file where I changed the value of a certificate - whose certificate file I do not have - from V to R to revoke it. The index.txt looks as follows exemplarily: V 220303095424Z ...
user avatar
  • 111
4 votes
3 answers
4k views

openvpn: crl has expired?

We have an OpenVPN in our aws setup which was set up by a client and now they are not able to connect to open vpn say "crl has expired" . We are trying to regenerate the crl but to do that we need to ...
user avatar
  • 41
2 votes
1 answer
5k views

How to verify Certificate Revocation List(s) against multiple certification paths

In a recent question, I outlined the steps for verifying a wildcard SSL certificate for connecting to PostgreSQL from a remote client (using the same wildcard certificate I use for my web server). ...
user avatar
0 votes
0 answers
67 views

How to delay CRL Renewal

I have a 3 Tier PKI and I have issued 90,000+ certificates. Within 2 days Root and Policy CA CRL is getting expired and I can't renew the Root and Policy CA CRL before 2 months so what is the best ...
user avatar
4 votes
1 answer
5k views

OpenVPN revoke user - CRL verify issues

I have configured my OpenVPN and it is working properly so far. Lately I had to revoke one certificate and after using easy-rsa revoke-full, I saw that in index.txt that specific user has been ...
user avatar
1 vote
0 answers
2k views

How does certutil determine that a cert is revoked

I'm testing that an x509 certificate can be correctly determined to be revoked. I'm taking the cert from https://revoked.badssl.com and verifying it via certutil. When my system is online, it seems to ...
user avatar
1 vote
1 answer
3k views

CRL revocation check failed

Issue with crl revocation check. I can telnet target server on port 80. I can download crl with internet explorer. But when i launch certutil : C:\Users\Administrateur\Desktop>certutil -urlfetch -...
user avatar
  • 129
0 votes
0 answers
2k views

openssl ca -gencrl is not working at all

Out of the blue, all clients cannot connect because the crl has expired. I am unable to generate a new crl. I currently have OpenVPN configured to ignore it for the time being because clients must be ...
user avatar
  • 3
1 vote
0 answers
556 views

CRL Checking and Proxy Server Authentication

We have an issue with our corporate Windows 10 clients checking Certificate Revocation Lists. When accessing websites or logging into apps etc we are seeing the popup message "Revocation Information ...
user avatar
3 votes
0 answers
920 views

OpenVPN service, run as root:root instead of nobody:nogroup?

This was moved from NetworkEngineering. I used this DigitalOcean guide (hereafter "guide") to set up an OpenVPN service (v2.3.10, OpenSSL 1.0.2g) several months ago. It's worked flawlessly, and it's ...
user avatar
  • 273
2 votes
0 answers
522 views

Keeping revocation lists up to date on Debian

I am using Debian Linux on several machines with different services (Apache, Freeradius, etc...) together with a Windows Server 2008R2 CA. I install the CA certificate by downloading it to /usr/local/...
user avatar
4 votes
0 answers
4k views

Active Directory Certificate Services cannot publish revocation list after renewal with new private Key

In summary: I had a working offline root CA and an AD integrated CA working fine I renewed the certificate with the same private key and all was good I then renewed the certificate with a new ...
user avatar
  • 133
5 votes
0 answers
29k views

The revocation function was unable to check revocation because the revocation server was offline

I have a chain of certificates: MYROOTCERT -> MYCHILDCERT. The MYCHILDCERT certificate has a CRL distribution point extension: [1]CRL Distribution Point Distribution Point Name: Full ...
user avatar
  • 219
3 votes
1 answer
2k views

How can I make OpenVPN use my CA's CRL Distribution Points when verifying certificates?

I have an existing PKI into which I am trying to integrate an OpenVPN server. I have included CRL Distribution Points into each CA certificate in my chain and I publish the CRLs at a location that is ...
user avatar
5 votes
1 answer
11k views

OpenSSL error while loading CRLnumber

I am unable to generate a CRL. I am probably missing something in the configuration file. The error I get is "openssl error while loading crl number." Crl config section: [ CA_default ] # Directory ...
user avatar
2 votes
1 answer
1k views

Updating IIS' default CRL (Certificate Revocation List)

I'm in the process of creating a (IIS 8.5) web server which will require client authentication. Client authentication will be carried out using client certificates which will be issued by a third ...
user avatar
1 vote
1 answer
1k views

RabbitMQ CRL Configuration

I've been trying to find available options for configuring CRL checking within RabbitMQ. RabbitMQ in turn seems to rely on Erlang's SSL library. Unfortunately, knowing very little about Erlang, so it ...
user avatar
  • 113
1 vote
1 answer
2k views

wininet 12057 error contacting crl server

My employer's client side application is failing when initiating ssl connection. It uses wininet and it fails on error 12057, certification revocation server is not available. Although crl url ...
user avatar
4 votes
1 answer
8k views

How do I change the expiration of CRLs with OpenSSL?

I am currently experimenting with my self signed CA. But in order for my devices to work I need a valid CRL. I set the CDP to one of the CDN hosting providers. As I have only 5 certificates issued I ...
user avatar
  • 127
2 votes
1 answer
3k views

Revoke multiple client certs signed by one CA: only the first one got denied?

OS: Ubuntu 12.04 OpenVPN version: 2.2.1-8 Setup: one CA cert, one server cert, multiple client certs Server config: port 1194 proto udp dev tun keepalive 10 120 comp-lzo user nobody group nogroup ...
user avatar
  • 50k
1 vote
1 answer
581 views

How to maintain revokation list for client certificates

I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates. I used to issue client certificates using Certificate Authority MMC snap-in. Since the ...
user avatar
3 votes
1 answer
10k views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
user avatar
  • 201
27 votes
4 answers
43k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
user avatar
6 votes
2 answers
10k views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
user avatar
  • 895
12 votes
1 answer
985 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
user avatar
  • 317
2 votes
1 answer
4k views

Windows 2012 SSTP The revocation function was unable to check revocation because the revocation server was offline

In order to get rid of "Error 0×80092013: The revocation function was unable to check revocation because the revocation server was offline" you have to install base/delta CRLs on the client you want ...
user avatar
3 votes
1 answer
5k views

Microsoft CRL URL's

We have a number of Exchange servers without access to the internet. When updating Exchange, the fact that all .NET assemblies are signed means the installer needs to check Microsoft's CRL during the ...
user avatar
3 votes
0 answers
1k views

The revocation function was unable to check revocation for the certificate

I need to pass IIS certificate authentication on Windows Server 2012. The root cert haven't got any revocation lists but I'm getting exception: The revocation function was unable to check ...
user avatar
3 votes
4 answers
5k views

Can I find out what certificate revocation server an application is contacting?

I'm trying to install an application on a machine running Windows XP Pro. There are two different servers being contacted, both using the same wildcard certificate (GoDaddy). One via https, one ...
user avatar
6 votes
2 answers
9k views

nginx proxy + ssl +clr "400 bad request" error

Here's the situation - there's a trasnparent nginx proxy that handles SSL certificates and does it well until we decide to add a revocation list management, required for security reasons. This is when ...
user avatar
1 vote
1 answer
2k views

How do I manually publish a CRL for a certificate?

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
user avatar
3 votes
1 answer
3k views

How often is CRL refreshed, and how to force it to be?

I have a web service running under IIS 7 that requires an X509 client certificate. I know that the server that it rus on needs access to DigiCert.com in order to be able to get the CRL (Certificate ...
user avatar
  • 133
4 votes
1 answer
6k views

How to reload Certificate Revocation List (CRL) in nginx?

I have set CRL file in nginx with ssl_crl directive: ssl_crl /mypath/crl.pem However, I noticed that adding or removing revoked certificates from crl.pem apply only when I restart or reload nginx ...
user avatar
  • 143
3 votes
1 answer
42k views

Revocation status of DC can't be verified

A Domain Controller within my forest was working fine (as the story usually goes). Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message: The system ...
user avatar
  • 211
4 votes
2 answers
1k views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
user avatar
  • 15.4k