0

In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process.

Is it really a person manually adding a certificate to the CRL when you no longer want that person to have access to the website?

  • 1
    I edited a few more details into your question. I hope that's ok. – Mike Ounsworth Jan 22 at 0:17
  • @MikeOunsworth, perfectly ok, thanks!! – Thomas Stringer Jan 22 at 19:36
1

In this context, a client certificate is really no different from any other certificate; the CA that issue the certificate is responsible for maintaining revocation information for it. Managing revocation information of certificates they issue is a core function of a certificate authority. When you pay for a certificate, this is one of the services you are paying for.

To be specific, every certificate will have either a CRL Distribution Point (for CRLs) and Authority Info Access (for OCSP) X.509 extension that point to the URL where revocation information for that certificate can be found. It is the CA's responsibility to maintain revocation information at those URLs.

CRL Distribution Point and Authority Info Access X.509 extensions

Updating and publishing CRLs is mostly automated, but there may be a human in the loop to actually mark your certificate as revoked, or not. depending on how the cert is revoked. For example, if you call an API to request your own cert be revoked, then almost certainly no humans are involved. If there's an ars technica news story about you horribly mis-managing your certificate's private key, then almost certainly some human at the CA will decide to revoke your cert for you ;)


Pulling this in from comments, even though it's a little outside the scope of the original question:

Alternatively, I've seen setups where someone's access to the site is taken away, but their certificate does not need to be revoked (for example, someone changes departments and still needs their client certs for other websites). That would be managed through whatever Roles / Permissions system is built into the website, and doesn't really have anything to do with certificates themselves or CRLs because the cert is still valid as far as the CA is concerned.

| improve this answer | |
  • Thanks for the answer! "If your web server has a certificate from a publicly-trusted CA, and the certificate gets revoked and placed on a CRL, you want to know who maintains that CRL?" Sorry, no, I meant the other way around. Is there is a client certificate that needs to be revoked and not allowed to access the server, who/what adds that client certificate to the CRL on the web server? – Thomas Stringer Jan 21 at 21:26
  • @ThomasStringer Hmm. Client certs are not nearly as common as server certs, so you may need to give a bit more info about your setup. I think it'll end up being the same answer though: whichever CA issued the client cert. More specifically, whoever controls the URL that the client cert's CRL Distribution Point extension points to. – Mike Ounsworth Jan 21 at 23:00
  • Alternatively, I've seen setups where someone's access to the site is taken away, but their certificate does not need to be revoked (for example, someone changes departments and still needs their client certs for other websites). That would be managed through whatever Roles / Permissions system is built into the website, and doesn't really have anything to do with certificates themselves or CRLs because the cert is still valid as far as the CA is concerned. – Mike Ounsworth Jan 21 at 23:07
  • That's great info, thank you! – Thomas Stringer Jan 22 at 0:04
  • @ThomasStringer You're most welcome :) I updated both your question and my answer to reflect the comments. – Mike Ounsworth Jan 22 at 0:31
-1

The default operating system comes with a system-default ca bundle. Typically the OS has an assigned ca bundle source (for updates) that's hashed/signed/in a repo.

e.g., cURL provides https://curl.haxx.se/ca/cacert.pem, however in RHEL 6+ OS's you can use the update-ca-trust tool, which again pulls from a signed source.

| improve this answer | |
  • 1
    Thanks for the information! Although I'm not sure this answers my question. Who/what on the web server would be creating and maintaining the CRL? Or maybe I'm too lost to see that answer in your post :) – Thomas Stringer Jan 21 at 21:16
  • @ThomasStringer the default and source is provided by the operating system so that would be i.e. Microsoft, RHEL, Fedora, Ubuntu, etc... Or are you trying to find the team / persons responsible? – MKN Web Solutions Jan 21 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.