I am having trouble finding a definitive answer (with a rationale) on what a reasonable default value for default_crl_days (in openssl.cnf) for use with OpenVPN.
The current default is 30 days. But regenerating a new CRL every month seems a bit excessive to me. And google suggests I'm not the only one...
OTOH my research consistently brings up 3650 days (i.e. 10 years) as a common updated default that is used.
So could someone please clarify:
- what are the implications of setting default_crl_days to 3650?
- what is a reasonable value for default_crl_days?
- why is 30 days seen as being (I assume) a sensible initial default?
I note that this answer (to a different but somewhat relevant question) states:
But note that if you set nextUpdate too far in the future you have to somehow guarantee that anybody checking the CRL is still using the latest one and not some old (but still valid) version which does not contain critical revocations.
If the server checks the client certs against the CRL (that exists on the server), then how could an "old (but still valid) version" be used (without access to the server)? How could that potentially be leveraged to gain access to the VPN illegitimately?
Quite clearly I'm missing something...
[update] After reading this somewhat related question, I think I understand the implications and potential attack vector a little better.
So it seems that the potential vulnerability is when a CRL with an extended (i.e. far in the future)
nextUpdate field (configured via
default_crl_days) is distributed amongst multiple servers. If a client certificate is revoked, but the primary CA is DoSed, then the updated CRL may not be distributed. That would allow an old CRL (prior to revocation), which is still valid, to allow the user/device to connect (even though the cert has been revoked by the primary CA). Right?
If I understand correctly, then I assume that leaving the
default_crl_days set to 30 and using a cron job to regenerate it before it expires (indefinitely) is probably a preferred method right?
OTOH, 30 days seems like a long time for a consistent DoS on the primary CA to go unnoticed?! A user/device whose cert has been revoked on the primary CA, still has (up to) 30 days to do their evil deeds...