Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have setup an ejbca pki and integrated certificates in MAC OS for S/MIME signing and encrypting. I have also set up a CRL distribution point and put the CRL online available on an HTTP server. Unfortunately, it appears that when I revoke a certificate and update the CRL, neither outlook or Mail clients seem to detect that the certificate is actually revoked. Does anyone has tips or advice that I could use to debug this?

the only option I found in MAC OS to check for CRL is in keychain options: preferences -> certificates : OCSP: check if certificates needs it CRL: check if certificate needs it priority: OCSP

what else should I check?

share|improve this question
up vote 0 down vote accepted

it worked after clearing the MAC OS CRL/OCSP cache which is located in /private/var/db/crls/.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.