Encryption and CRL

[uweiss]

Hi,

I'm moving all connections to certificate based encryption. All the certificates, CRLs and configurations are deployed automatically using Puppet (OK, the CRL not yet, but soon).

As i don't expect to revoke certificates a lot i'm asking me how it will behave in case when the CRL expires (root or intermediate). Will the server/proxy/agent deny further connections or will they ignore the expire date?

As Zabbix uses a local file to check revocation, a very long expire date would not matter a lot because Puppet will distribute and restart the services within 30 minutes after a certificate was revoked anyway. But would simply like to know how it would behave in such a case.


Thank you,
Urs

[uweiss]

Since the CRL of my intermediate CA expired yesterday, in know it for sure now.

If the CRL expires Zabbix will block connections:

22331:20160805:082303.680 failed to accept an incoming connection: from 11.22.33.44: CRL has expired: TLS handshake returned error code 1: file s3_srvr.c line 3288: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned: TLS write fatal alert "certificate expired"

So i would recommend to use a separate CA for Zabbix certs only (what i luckily have anyway) and set a very long CRL expiration. You still have to update your root CA CRL from time to time, but this normally has a longer CRL lifetime.

Might could be a new configuration option to allow Zabbix services to ignore expired CRLs. In my case, if i have to revoke a Zabbix cert the CRL is anyway distributed automatically to all agents, servers and proxies.