Search code examples
tomcatsslopensslssl-certificateclient-certificates

Configuring Tomcat to check CRL Distribution Points

I'm writing a webapp which requires incoming connections to use client certificates for security. I've set it up to only accept secure connections, and to use clientAuth=true.

I've been trying to check that it rejects certificates which have been revoked, but it doesn't seem to be checking the CRL. This is the first time I've really tried using CRLs so it's possible/likely I've done something wrong...

Test setup:

  1. created test CA in openssl which has been added to the truststore for the server
  2. created CRL for CA, and added config settings to openssl to include a crl distribution point in client certificates (using Howto create a certificate using openssl including a CRL distribution point?)
  3. created two client certificates using CA
  4. revoked one of the client certs, updated crl and placed it in address specified as distribution point (have since checked the contents of this CRL and it does list ID of cert as revoked)

After setting this up, I've tried making connections to the application using both certificates, however it lets both connect successfully, even though one of them is revoked?

Is there a setting I've missed in Tomcat that makes it check the CRL distribution point when it receives a client certificate? I would have thought that would be default behaviour.

I've found various references to settings which allow you to embed a crl location into the Connector in tomcat - that isn't what I'm looking for. This system will eventually be configured to accept certificates from a number of different CAs.

Solution

  • Assuming you're using the Oracle/OpenJDK JRE, if you scroll down at the bottom of the Certification Path API guide (Appendix B), you'll find CRLDP can be enabled with the com.sun.security.enableCRLDP system property:

    Support for the CRL Distribution Points extension is available. It is disabled by default for compatibility and can be enabled by setting the system property com.sun.security.enableCRLDP to the value true.

    You may also be interested in the following section, about OCSP.