Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of jorton@redhat.com designates
 66.187.233.31 as permitted sender)
Date: Tue, 26 Feb 2008 18:57:32 +0000
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: mod_ssl & CRL verification
Message-ID: <20080226185732.GA18550@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: <20080225221243.GA26447@redhat.com>
 <47C34742.80006@oss-institute.org> <20080226161513.GA11569@redhat.com>
 <47C4439C.1090200@oss-institute.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <47C4439C.1090200@oss-institute.org>
User-Agent: Mutt/1.5.17 (2007-11-01)
Organization: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor,
 Berkshire, SL4 1TE, United Kingdom.
  Registered in UK and Wales under Company Registration No. 03798903
  Directors: Michael Cunningham (USA), Brendan Lane (Ireland),
 Matt Parson (USA), Charlie Peters (USA)

On Tue, Feb 26, 2008 at 04:51:40PM +0000, Dr Stephen Henson wrote:
> Well the current CRL strategy has a few problems. It ignores critical 
> extensions but that's a separate issue...

I was looking at this recently; is it still true that mod_ssl has to do 
so much of the CRL revocation checks for client certs itself (i.e. all 
of ssl_callback_SSLVerify_CRL) - it looks like X509_verify_cert() can do 
revocation checks itself if suitably configured, though maybe this is a 
recent addition?

> Many CRLs have short lifetimes and need to be updated fairly often which 
> causes problems when the server needs to be restarted each time.
...
> Well that's one strategy... another would be to use OCSP exclusively and 
> have a local OCSP responder driven by CRLs.

Right, that is exactly my view.  I think that any attempt to make 
mod_ssl treat CRLs as anything other than static files loaded once at 
startup will end up trying to reinvent OCSP badly.

If a free OCSP responder existed which actually did this maybe those 
"make CRL handling better" bug reports would go away :)

joe