Questions tagged [crl]
A Certificate Revocation List (CRL) is a blacklist of revoked or compromised serial numbers of certificates. As a serial number has no direct relationship to a certificate and can be fabricated in a compromised CA, it is considered a weak blacklist.
73
questions
1
vote
0
answers
467
views
Windows CA Publishing Expired Certs in CRL When not configured to do so
I have a Windows ADDS CA that for some reason is publishing revoked but expired certificates in the CRL and I can't for the life of me figure out why. Here is my configuration:
Server 2012 R2
...
- 33
1
vote
1
answer
2k
views
What determines the CRL expiration date and validity in PKI?
I'm working with Microsoft's Public Key Infrastructure (PKI) and I'm interested to know more about how the expiration date of a CRL is determined and how it can be adjusted in a Microsoft PKI ...
- 53
0
votes
0
answers
407
views
Are crl updated automatically to user after a certificate is being revoke?
I'm clueless on how does this CRL/OCSP works. We do have a local enterprise CA, and was set on the CRL publication interval to 8 days. As what was told, when the certificate is revoked, it does not ...
- 1
1
vote
0
answers
662
views
Need help figure out why I can logon to Windows with a revoked smartcard certificate
I am adding smart card login to our domain and have got almost everything working properly except that when I revoke the certificate on our Enterprise CA I can still log into computers.
I have checked ...
- 11
1
vote
2
answers
654
views
What is the best practice to handle expiring S/MIME mail certificates
where can I find info regarding the proper way to handle expiring mail certificates?
Here's the problem: our certificates for digitally signing mails expire after a year. If, a week before expiry, I ...
0
votes
1
answer
1k
views
Can a server certificate from a CA not have CRL URLs?
I'm trying create a validation for server certificates and one of the things I need to do is to check if the certificate is revoked, but the server certificates from a specific server seems to not ...
- 103
-1
votes
1
answer
2k
views
CertUtil: The directory service encountered an unknown failure. 0x800720ef (WIN32: 8431 ERROR_DS_UNKNOWN_ERROR)
I am trying to publish revoked certificates and I am getting an unknown failure when using the Certificate Authority console:
The Application Log in the Event Viewer:
It says:
Active Directory ...
- 99
4
votes
1
answer
1k
views
Revoked certificate is still valid by Google Chrome and Microsoft Edge
I have generated Self-Signed Certificate, Root-CA Signed by Root-CA
Then, Intermediate-CA Signed by Root-CA and Server Signed by Intermediate-CA
The certificates as given below:
Root-CA -> ...
- 76
0
votes
2
answers
4k
views
OpenVPN issue verifying CRL
With an OpenVPN/EasyRSA 3 setup (split machines for CA and VPN entry point), I'm facing the issue that whatever CRL I generate, OpenVPN seemingly cannot handle it.
Setup Overview: Things That Go Well
...
- 101
4
votes
1
answer
13k
views
Update CRL with OpenVPN server for longer expiration?
If the error "VERIFY ERROR: depth=0, error=CRL has expired" is received when a client attempts to connect to the OpenVPN server, it can be fixed as follows:
cd /etc/openvpn/easy-rsa
easyrsa ...
- 151
1
vote
2
answers
2k
views
How to Delete CRL Files in Local Cert Store
I need to import CRL files to a Bastion server that is not part of my environments domain. The CRL files are updated every few days so a new copy needs to be imported to the local cert store on the ...
- 698
0
votes
1
answer
5k
views
Domain Member Servers - Accessing Certificate Revocation List (CRL)
In my environment I have a Enterprise Root CA installed on a domain controller and a separate domain controller configured as a Subordinate CA - I know this isn't recommended for security reasons but ...
- 698
0
votes
1
answer
350
views
How does OCSP handle deleted certificates?
We have a Microsoft Certificate Authority running on Windows Server 2019. We are issuing certificates to Android devices via a MDM. The Android device users browse to a web application (hosted by ...
1
vote
0
answers
1k
views
Revoked certificate not getting into Microsoft CA CRL
I have a CA and an Active Directory + ADFS instances set up on a Windows Server 2016 machine. I issued a client certificate for one of the users (for smart card logon) and then revoked it. However, I'...
- 11
0
votes
1
answer
2k
views
Ldap service not running on Windows Server 2019
I have 2 windows server 2019. e.g. server1 and server2.
server1 is the domain controller.
server1 has below roles installed: ADDS, ADCS, DNS, FILE STORAGE, IIS.
server2 is connected to that domain ...
- 101
1
vote
1
answer
2k
views
CRL distribution point with multiple names
I'd like to create a certificate with CRL discribution point, which contains multiple URLs (poiting to the same CRL, according to RFC 5280):
When OpenSSL parses such certificate, it shows something ...
- 113
3
votes
0
answers
2k
views
NGINX Client Certificate with Indirect CRL
I'm trying to implement mTLS using Nginx SSL Module. Everything works fine until I give Nginx CRL files concatenated in PEM format because one of the CRL is an Indirect CRL.
The chain for a leaf ...
- 131
0
votes
1
answer
862
views
number of crl certificate(s) or pem certificate(s) present in p7s file
Q. How can we find out the number of CRL files or number of PEM files that can be generated from a P7S file?
I understand ( from here ) that the data that is contained in a P7S file is nothing but the ...
- 135
3
votes
1
answer
7k
views
Check SSL certificate against CRL when an intermediate CA is in the way
I am trying to understand how to check an SSL certificate, taking into account any relevant published CRL when the certificate chain is the following:
Root CA (with no CRL distribution points)
...
- 303
1
vote
1
answer
1k
views
OpenSSL invalid revocation date / update CRL?
I have an index.txt file where I changed the value of a certificate - whose certificate file I do not have - from V to R to revoke it.
The index.txt looks as follows exemplarily:
V 220303095424Z ...
- 111
5
votes
3
answers
7k
views
openvpn: crl has expired?
We have an OpenVPN in our aws setup which was set up by a client and now they are not able to connect to open vpn say "crl has expired" .
We are trying to regenerate the crl but to do that we need to ...
- 51
2
votes
1
answer
8k
views
How to verify Certificate Revocation List(s) against multiple certification paths
In a recent question, I outlined the steps for verifying a wildcard SSL certificate for connecting to PostgreSQL from a remote client (using the same wildcard certificate I use for my web server). ...
- 783
0
votes
0
answers
109
views
How to delay CRL Renewal
I have a 3 Tier PKI and I have issued 90,000+ certificates. Within 2 days Root and Policy CA CRL is getting expired and I can't renew the Root and Policy CA CRL before 2 months so what is the best ...
Manish
4
votes
1
answer
7k
views
OpenVPN revoke user - CRL verify issues
I have configured my OpenVPN and it is working properly so far. Lately I had to revoke one certificate and after using easy-rsa revoke-full, I saw that in index.txt that specific user has been ...
- 162
1
vote
0
answers
3k
views
How does certutil determine that a cert is revoked
I'm testing that an x509 certificate can be correctly determined to be revoked. I'm taking the cert from https://revoked.badssl.com and verifying it via certutil. When my system is online, it seems to ...
- 111
1
vote
1
answer
6k
views
CRL revocation check failed
Issue with crl revocation check.
I can telnet target server on port 80.
I can download crl with internet explorer.
But when i launch certutil :
C:\Users\Administrateur\Desktop>certutil -urlfetch -...
- 165
0
votes
0
answers
3k
views
openssl ca -gencrl is not working at all
Out of the blue, all clients cannot connect because the crl has expired. I am unable to generate a new crl. I currently have OpenVPN configured to ignore it for the time being because clients must be ...
- 3
1
vote
0
answers
813
views
CRL Checking and Proxy Server Authentication
We have an issue with our corporate Windows 10 clients checking Certificate Revocation Lists. When accessing websites or logging into apps etc we are seeing the popup message "Revocation Information ...
- 225
3
votes
1
answer
1k
views
OpenVPN service, run as root:root instead of nobody:nogroup?
This was moved from NetworkEngineering.
I used this DigitalOcean guide (hereafter "guide") to set up an OpenVPN service (v2.3.10, OpenSSL 1.0.2g) several months ago. It's worked flawlessly, and it's ...
- 293
2
votes
0
answers
800
views
Keeping revocation lists up to date on Debian
I am using Debian Linux on several machines with different services (Apache, Freeradius, etc...) together with a Windows Server 2008R2 CA. I install the CA certificate by downloading it to /usr/local/...
- 41
4
votes
0
answers
6k
views
Active Directory Certificate Services cannot publish revocation list after renewal with new private Key
In summary:
I had a working offline root CA and an AD integrated CA working fine
I renewed the certificate with the same private key and all was good
I then renewed the certificate with a new ...
- 133
6
votes
0
answers
38k
views
The revocation function was unable to check revocation because the revocation server was offline
I have a chain of certificates: MYROOTCERT -> MYCHILDCERT. The MYCHILDCERT certificate has a CRL distribution point extension:
[1]CRL Distribution Point
Distribution Point Name:
Full ...
- 251
3
votes
1
answer
3k
views
How can I make OpenVPN use my CA's CRL Distribution Points when verifying certificates?
I have an existing PKI into which I am trying to integrate an OpenVPN server. I have included CRL Distribution Points into each CA certificate in my chain and I publish the CRLs at a location that is ...
6
votes
1
answer
14k
views
OpenSSL error while loading CRLnumber
I am unable to generate a CRL. I am probably missing something in the configuration file. The error I get is "openssl error while loading crl number."
Crl config section:
[ CA_default ]
# ...
- 63
2
votes
1
answer
2k
views
Updating IIS' default CRL (Certificate Revocation List)
I'm in the process of creating a (IIS 8.5) web server which will require client authentication. Client authentication will be carried out using client certificates which will be issued by a third ...
- 123
1
vote
1
answer
2k
views
RabbitMQ CRL Configuration
I've been trying to find available options for configuring CRL checking within RabbitMQ. RabbitMQ in turn seems to rely on Erlang's SSL library. Unfortunately, knowing very little about Erlang, so it ...
- 113
1
vote
1
answer
3k
views
wininet 12057 error contacting crl server
My employer's client side application is failing when initiating ssl connection. It uses wininet and it fails on error 12057, certification revocation server is not available.
Although crl url ...
- 65
4
votes
1
answer
12k
views
How do I change the expiration of CRLs with OpenSSL?
I am currently experimenting with my self signed CA.
But in order for my devices to work I need a valid CRL.
I set the CDP to one of the CDN hosting providers.
As I have only 5 certificates issued I ...
- 126
2
votes
1
answer
3k
views
Revoke multiple client certs signed by one CA: only the first one got denied?
OS: Ubuntu 12.04
OpenVPN version: 2.2.1-8
Setup: one CA cert, one server cert, multiple client certs
Server config:
port 1194
proto udp
dev tun
keepalive 10 120
comp-lzo
user nobody
group nogroup
...
- 52.1k
1
vote
1
answer
684
views
How to maintain revokation list for client certificates
I have a website running in Windows Server 2012, IIS.
User's are authenticated using client certificates.
I used to issue client certificates using Certificate Authority MMC snap-in.
Since the ...
3
votes
1
answer
11k
views
Certificate revocation check fails for non-domain guest in spite of accessible CRL
When we try to use certificates on computers that are not part of the domain, Windows complains that
The revocation function was unable to check revocation because the revocation server was ...
- 201
28
votes
4
answers
52k
views
How do I check if my SSL certificates have been revoked
The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates.
I have two certificates that were generated before the heartbleed vulnerability ...
7
votes
2
answers
13k
views
How to check multiple CRL lists with nginx client authentication?
I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this:
RootCA
+----- AdminUserCA
+----- EmployeeCA
+----- ...
- 935
12
votes
1
answer
1k
views
How to use Chrome's CRL sets (or some master CRL list) as a CRL file?
I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
- 317
2
votes
1
answer
5k
views
Windows 2012 SSTP The revocation function was unable to check revocation because the revocation server was offline
In order to get rid of "Error 0×80092013: The revocation function was unable to check revocation because the revocation server was offline" you have to install base/delta CRLs on the client you want ...
- 164
3
votes
1
answer
6k
views
Microsoft CRL URL's
We have a number of Exchange servers without access to the internet. When updating Exchange, the fact that all .NET assemblies are signed means the installer needs to check Microsoft's CRL during the ...
- 71
3
votes
0
answers
2k
views
The revocation function was unable to check revocation for the certificate
I need to pass IIS certificate authentication on Windows Server 2012. The root cert haven't got any revocation lists but I'm getting exception:
The revocation function was unable to check ...
- 131
3
votes
4
answers
6k
views
Can I find out what certificate revocation server an application is contacting?
I'm trying to install an application on a machine running Windows XP Pro.
There are two different servers being contacted, both using the same wildcard certificate (GoDaddy). One via https, one ...
- 131
7
votes
2
answers
10k
views
nginx proxy + ssl +clr "400 bad request" error
Here's the situation - there's a trasnparent nginx proxy that handles SSL certificates and does it well until we decide to add a revocation list management, required for security reasons. This is when ...
- 140
1
vote
1
answer
3k
views
How do I manually publish a CRL for a certificate?
I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
- 111