CRL verification in Irule

Hi Hille,

 

 

Are you using the advanced client auth license to check the CRL? I worked with a poster here for a similar situation with OCSP authentication where the person had two different CA's OCSP servers they needed to check client certs against. The solution we came up with was to use a VIP and iRule to select the correct OCSP URL based on the client cert that was being validated. We then configured this VIP as the URL for the OCSP responder. I imagine you could do something similar for the CRL. This CRL load balancing VIP would be used internally to perform the CRL validation--not as a second VIP that the clients connect to.

 

 

If this seems like it might work for your scenario, let me know and I'll try to clean up and anonymize the OCSP example. It might also be worth checking with either an F5 account manager/presales person or F5 Support to see if there's a simpler solution.

 

 

Aaron

Hi Aaron,

 

 

We are not using the advanced client auth license. Also the provider doesn't support OCSP.

 

We also opent a case by F5 and they replied with the following

 

 

-------------------------------------------------------------------------------------------------------

 

Creating an aggregate CRL file

 

If you need to revoke certificates from more than one CA, you can create an aggregate CRL file simply by concatenating the CRL files from each CA.

 

For example, if you have a CRL file generated by a commercial CA, commercial_crl.pem, and another CRL file generated by a home-grown OpenSSL CA, openssl_crl.pem, you can combine these into a single CRL file as follows:

 

Windows:

 

copy commercial_crl.pem + openssl_crl.pem crl.pem

 

UNIX:

 

cat commercial_crl.pem openssl_crl.pem > crl.pem

 

-------------------------------------------------------------------------------------------------------

 

 

I concatenated the two CRL files to one aggregated file and loaded it into the SSL client profile.

 

It works for both client certificates........., but I still have to test it with client certificates that are revoked (I'm waiting for the provider to provide me two certificates that are revoked)

 

 

Hille

Sorry, I thought you were using CRL/CRLDP with an advanced client auth profile. Support's suggestion seems logical for using two CRL files.

 

 

Aaron