Keep Server Online
If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.
or
A donation makes a contribution towards the costs, the time and effort that's going in this site and building.
Thank You! Steffen
Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
| |
|
 Topic: Apache allowing revoked certificates |
|
| Author |
|
apachenubee
Joined: 05 Nov 2015
Posts: 2
Location: US, DC
|
 Posted: Fri 06 Nov '15 15:22 Post subject: Apache allowing revoked certificates |
 |
|
Hello All, I am fairly new to Linux and completely new to Apache. I have set up Apache as reverse proxy to Tomcat. I have a test CA (openSSL)that I used to generate client certificates and a CRL. I copied CRL to Apache server and pointed to it in .conf file but users with revoked certificates are still able to access the site. I included part of the httpd.conf file. I am not sure if I need to add something or if something is misconfigured. Any help is greatly appreciated. Thanks in advance! 
RHEL 6.6 - Apache 2.4 - openSSL 1.0.1
httpd.conf
<VirtualHost 192.168.0.11:443>
DocumentRoot /opt/www/
SSLEngine on
SSLOptions +ExportCertData +StdEnvVars
SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /www/apache/ssl/ca_cert.pem
SSLOptions +FakeBasicAuth
SSLCertificateFile /www/apache/ssl/test_dev.crt
SSLCertificateKeyFile /www/apache/ssl/test_dev.key
SSLCARevocationFile /www/apache/ssl/crl/crl.pem
SSLProxyEngine on
...
....
.....
</VirtualHost> |
|
| Back to top |
|
apachenubee
Joined: 05 Nov 2015
Posts: 2
Location: US, DC
|
| Posted: Tue 10 Nov '15 14:08 Post subject: Found answer |
|
|
After reading the mod_ssl manual again, I noticed I was missing the SSLCARevocationCheck directive.
Enables certificate revocation list (CRL) checking. At least one of SSLCARevocationFile or SSLCARevocationPath must be configured. When set to chain (recommended setting), CRL checks are applied to all certificates in the chain, while setting it to leaf limits the checks to the end-entity cert. |
|
| Back to top |
|
|
|
|
|
|
