mimo

Asked: 2020-08-19 05:40:56 +0800 CST

Check SSL certificate against CRL when an intermediate CA is in the way

3

I am trying to understand how to check an SSL certificate, taking into account any relevant published CRL when the certificate chain is the following:

Root CA (with no CRL distribution points)
- Intermediate CA (advertising a CRL distribution point signed by the root CA)
  - Website certificate (advertising a CRL DP signed by the intermediate CA)

So, two CRL lists need to be checked.

It happens that BBC's website is configured as indicated above, so let's take this as an example. The files that I used are at the end of this question.

When I try to verify the certificate without checking the CRL, it's fine:

$ openssl verify -CAfile intermediate_fullchain.pem bbc.pem
bbc.pem: OK

When I try to check the CRL from the CRL URLs given in the certificates, I get an error:

$ openssl verify -crl_download -crl_check_all -CAfile intermediate_fullchain.pem bbc.pem
Error loading CRL from http://crl.globalsign.com/gsrsaovsslca2018.crl
C = GB, ST = London, L = London, O = British Broadcasting Corporation, CN = www.bbc.com
error 3 at 0 depth lookup: unable to get certificate CRL
error bbc.pem: verification failed

This makes sense to me as the crl files are in DER format while openssl wants PEM format, so let's download the CRLs and convert them to PEM. The CRL URLs can be found using:

$ openssl x509 -in bbc.pem -text -noout
$ openssl x509 -in intermediate_fullchain.pem -text -noout

Then, I did:

$ wget -O intermediate_crl.der http://crl.globalsign.com/gsrsaovsslca2018.crl
$ openssl crl -inform DER -in intermediate_crl.der -outform PEM -out intermediate_crl.pem
$ wget -O root_crl.der http://crl.globalsign.com/root-r3.crl
$ openssl crl -inform DER -in root_crl.der -outform PEM -out root_crl.pem

Now, I thought I had everything I need to validate the certificate:

$ openssl verify -crl_check_all -CRLfile intermediate_crl.pem -CRLfile root_crl.pem -CAfile intermediate_fullchain.pem bbc.pem
OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
error 3 at 2 depth lookup: unable to get certificate CRL
error bbc.pem: verification failed

But, No! Verification still fails. My questions:

What exactly is the issue in the command above? Does it mean OpenSSL expects the root CA to have a CRL?
What is the right way to check the certificate against the two CRLs advertised in the CA chain?

Files

bbc.pem: the webserver certificate:

intermediate_fullchain.pem: the intermediate CA certificate, with the chain to the root CA:

Moutabreath

Asked: 2017-01-03 02:04:25 +0800 CST

OpenSSL error while loading CRLnumber

5

I am unable to generate a CRL. I am probably missing something in the configuration file. The error I get is "openssl error while loading crl number." Crl config section:

 [ CA_default ]
# Directory and file locations.
dir               = box/ca
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand
# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/RcCA.crl
crl_extensions    = crl_ext
default_crl_days  = 30

The command I use:

openssl ca -config full-path-to-openssl.cnf  -gencrl -out full-path-to-RcCA.crl

Where rcCA is the crl file. File structure:
root CA

certs
crl
csr
intermediate
newcerts
pfx
private
serial
openssl.cnf
index.txt
crlnumber

Bottom three are files, above are folders.
The answers I've found are pointing to the lack of index file. But it exists on my machine. I don't know if I put it in the right place.

Edit:

@StacksOfZtuff helped. But now I am getting different errors. I don't know if this is considered resolved or I am just masking the previous error.

22048:error:2207707B:X509 V3 routines:V2I_AUTHORITY_KEYID:unable to get issuer keyid:.\crypto\x509v3\v3_akey.c:165:

22048:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:.\crypto\x509v3\v3_conf.c:95:name=authorityKeyIdentifier, value=keyid:always

Edit to second comment:

I would like to emphasize, my CA is working properly, except for the CRL issue. I am able to generate key,csr, cer and pkcs12. I seem to be able to add entries to the CRL, but when I try to call the gencrl command, I get errors. I am not even sure if it matters

Can Windows log CryptoAPI CRL timouts?

6

I suspect that the process of building the CRL cache may cause latency in some applications.

We have several .NET applications that occasionally "act slow" with no CPU or disk access. I suspect that they are hung up on authentication when trying to validate the certificate, since the timeout is almost 20 seconds.

As per this MSFT article

Most applications do not specify to CryptoAPI to use a cumulative time-out. If the cumulative time-out option is not enabled, CryptoAPI uses the CryptoAPI default setting which is a time-out of 15 seconds per URL. If the cumulative time-out option specified by the application, then CryptoAPI will use a default setting of 20 seconds as the cumulative timeout. The first URL receives a maximum timeout of 10 seconds. Each subsequent URL timeout is half of the remaining balance in the cumulative timeout value.

Since this is a service, how can I detect and log CryptoAPI hangs for applications I have sourcecode to, and also 3rd party

makerofthings7

Asked: 2012-06-02 19:06:27 +0800 CST

How large is the certificate OCSP and CRL cache in my Windows server?

6

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers?

In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP relevant for that application. This is important since there is a huge performance tradeoff between client memory usage and quantity of network IO requests.

In my case the CRL "client" is a server that validates WCF certificate authentication

Image of nTier PKI

Sasha

Asked: 2011-06-23 02:09:20 +0800 CST

Reset local Certificate Revocation List (CRL) manual

3

How can I reset local CRL (in OS local cash) in Windows OS (XP, Windows 7) manual? We need to reset local CRL because otherwise the OS will use local CRL until "next update" period.

As described in "Manually publish the CRL":

Clients that have a cached copy of the previously-published CRL or delta CRL will continue using it until its validity period has expired, even though a new CRL has been published. Manually publishing a CRL does not affect cached copies of CRLs that are still valid; it only makes a new CRL available for systems that do not have a valid CRL.

Check SSL certificate against CRL when an intermediate CA is in the way

Files

OpenSSL error while loading CRLnumber

Edit:

Edit to second comment:

See also

Can Windows log CryptoAPI CRL timouts?

How large is the certificate OCSP and CRL cache in my Windows server?

Reset local Certificate Revocation List (CRL) manual

Can you pass user/pass for HTTP Basic Authentication in URL parameters?

Ping a Specific Port

Check if port is open or closed on a Linux server?

How to automate SSH login with password?

How do I tell Git for Windows where to find my private RSA key?

What's the default superuser username/password for postgres after a new install?

What port does SFTP use?

Command line to list users in a Windows Active Directory group?

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

How to determine if a bash variable is empty?

Questions[crl](server)

Files

Edit:

Edit to second comment:

See also