19-Sep-2022 20:46
Hi
Can someone explain to me if and how SSLO does CRL checks? I assume that it should automatically perform these certificate revocation checks on behalf of the client since it proxies the client's connection. Other proxy servers are explicit and clear on what they do and how they do this, but I've struggled to find concise information on how it works on SSLO.
I see CRL and OSCP check boxes that can be configured in SSL configuration in SSLO GUI, but I struggle to understand how this will work since each public webserver indicates its OCSP responder or CRL DP.
Any help on how SSLO does certificate revocation checks, or if it has to be manually configured, will be appreciated.
20-Sep-2022 02:23
Hello Elemzy,
I hope I'm not out of line. I had seen in the link below https://clouddocs.f5.com/training/community/sslviz/html/archive3/module1/lab05.html a brief explanation of the CRL and OSCP options in the SSL Configurations.
Best Regards,
Maxime AUDRAIN
20-Sep-2022 06:45
29-Sep-2022 03:48
revoked.badssl.com probably isn't a good test. Server side OCSP will attempt to perform one of two functions:
revoked.badssl.com neither participates in OCSP stapling nor contains an AIA field. A better option would be revoked.grc.com. You can see the cert attributes like this:
echo | openssl s_client -connect revoked.badssl.com:443 -showcerts 2>&1 |sed -n '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' |openssl x509 -noout -text
echo | openssl s_client -connect revoked.grc.com:443 -showcerts 2>&1 |sed -n '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' |openssl x509 -noout -text
27-Oct-2022 09:38 - edited 27-Oct-2022 21:03
Hi Kevin,
I see the difference between both sites on the F5, but I did find an AIA field in the revoked.badssl.com certificate in both firefox and edge.
I also got a response from F5 support, and I was asked to change the "Trusted Responders" field to none. SSL started blocking revoked.badssl.com after this change, and I got the following in my log "Certificate with subject name (/CN=revoked.badssl.com) and serial number (0X0D2E67A298853B9A5452E3A285A4572F) is revoked"
I asked for the rationale behind this change, but I've not gotten a response.