Search code examples
ldapldifopendjcertificate-revocation

Certificate revocation list in LDAP

I need to store a Certificate Revocation List in LDAP server (OpenDJ). I have used ldapmodify command to store a certificate in the LDAP server by adding entries to LDIF files. However, I am not really sure how to go about adding a revocation list in the LDAP server.

Any examples using LDIF would be really appreciated.

Solution

  • As EJP pointed out, there is a standard schema for CRL.
    Just one thing, LDAP doesn't have a specific syntax for CRLs or Certificates.
    The CRL needs to be treated as an opaque blob and you will need to use the ;binary transfer option when creating, updating or retrieving the attribute.
    In LDIF, it's as simple as:
    certificateRevocationList;binary:: BASE64_Encoding of CRL