Forum Discussion
Hille_de_Graaf_
Nimbostratus
Nimbostratusbypass a CRL with an invalid date
Hi,
We are using client certificates and a CRL (Certificate Revocation List) to check wether the client certificate is revocated.
Every night we are loading a new CRL from our provider ...
Hello Hille,
I tested your rule with an expired CRL and for me anyway, it DOES allow the traffic through. I see the following three messages:
"Found CRL is expired -- revoking all certificates until current CRL is available."
Rule crltest : ClientSSL_Client handshake status: CRL has expired
Rule crltest : CRL date is not valid, but you may continue
I also tested your rule with a revoked certificate and it redirects to "certerror.htm"
Do you not see the "you may continue" message when you run your rule?
