Forum Discussion
Hille_de_Graaf_
Nimbostratus
NimbostratusCRL verification in Irule
Hi,
Is it possible to verify a SSL CRL (Certificate Revocation List) within an iRule?
The reason why is, that we have two different CA Issuers (from de same PKI company) with two different CRL's.
Note.
We can only use one Virtual Server
Or does anyone knows if you can make a CRL bundle.
Regard,
Hille
hoolioCirrostratus
Hi Hille,
Are you using the advanced client auth license to check the CRL? I worked with a poster here for a similar situation with OCSP authentication where the person had two different CA's OCSP servers they needed to check client certs against. The solution we came up with was to use a VIP and iRule to select the correct OCSP URL based on the client cert that was being validated. We then configured this VIP as the URL for the OCSP responder. I imagine you could do something similar for the CRL. This CRL load balancing VIP would be used internally to perform the CRL validation--not as a second VIP that the clients connect to.
If this seems like it might work for your scenario, let me know and I'll try to clean up and anonymize the OCSP example. It might also be worth checking with either an F5 account manager/presales person or F5 Support to see if there's a simpler solution.
Aaron
Hille_de_Graaf_Hi Aaron,
We are not using the advanced client auth license. Also the provider doesn't support OCSP.
We also opent a case by F5 and they replied with the following
-------------------------------------------------------------------------------------------------------
Creating an aggregate CRL file
If you need to revoke certificates from more than one CA, you can create an aggregate CRL file simply by concatenating the CRL files from each CA.
For example, if you have a CRL file generated by a commercial CA, commercial_crl.pem, and another CRL file generated by a home-grown OpenSSL CA, openssl_crl.pem, you can combine these into a single CRL file as follows:
Windows:
copy commercial_crl.pem + openssl_crl.pem crl.pem
UNIX:
cat commercial_crl.pem openssl_crl.pem > crl.pem
-------------------------------------------------------------------------------------------------------
I concatenated the two CRL files to one aggregated file and loaded it into the SSL client profile.
It works for both client certificates........., but I still have to test it with client certificates that are revoked (I'm waiting for the provider to provide me two certificates that are revoked)
Hille- hoolioSorry, I thought you were using CRL/CRLDP with an advanced client auth profile. Support's suggestion seems logical for using two CRL files.
Aaron