Home/ Questions/Q 8653231
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T14:29:39+00:00

I’m writing a webapp which requires incoming connections to use client certificates for security.

  • 0

I’m writing a webapp which requires incoming connections to use client certificates for security. I’ve set it up to only accept secure connections, and to use clientAuth=true.

I’ve been trying to check that it rejects certificates which have been revoked, but it doesn’t seem to be checking the CRL. This is the first time I’ve really tried using CRLs so it’s possible/likely I’ve done something wrong…

Test setup:

  1. created test CA in openssl which has been added to the truststore
    for the server
  2. created CRL for CA, and added config settings to openssl to include a crl distribution point in client certificates (using
    Howto create a certificate using openssl including a CRL distribution point?)
  3. created two client certificates using CA
  4. revoked one of the client certs, updated crl and placed it in address specified as distribution point (have since checked the
    contents of this CRL and it does list ID of cert as revoked)

After setting this up, I’ve tried making connections to the application using both certificates, however it lets both connect successfully, even though one of them is revoked?

Is there a setting I’ve missed in Tomcat that makes it check the CRL distribution point when it receives a client certificate? I would have thought that would be default behaviour.

I’ve found various references to settings which allow you to embed a crl location into the Connector in tomcat – that isn’t what I’m looking for. This system will eventually be configured to accept certificates from a number of different CAs.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Assuming you’re using the Oracle/OpenJDK JRE, if you scroll down at the bottom of the Certification Path API guide (Appendix B), you’ll find CRLDP can be enabled with the com.sun.security.enableCRLDP system property:

    Support for the CRL Distribution Points extension is available. It is
    disabled by default for compatibility and can be enabled by setting
    the system property com.sun.security.enableCRLDP to the value true.

    You may also be interested in the following section, about OCSP.

    • 0