I have an Apache server with mod_ssl loaded. My server is configured to verify client certificates. The client certificates are issued by an internal CA.
Client certificates contain the "CRL Distribution Point" x509 extension. The specified distribution points are HTTP servers under the CA's responsibility.
CRL-related stuff I'd like Apache to do, when a client certificate is validated:
- Check for a cached CRL.
- Make sure the cached version is still valid (I guess that means
if currentTime < nextUpdate) - Fetch a valid copy if it isn't
- Make sure the client certificate is not blacklisted.
I've found Apache's CRL-related directive (SSLCARevocationCheck , SSLCARevocationPath, SSLCARevocationFile), but those seem to expect the CRL to be a static file, specified before the requests are received.
This design decision seems to be incompatible with the CRL Distribution Points extension. (Detour question - Am I missing something here?)
Is there a way to configure Apache to behave as desired? If not, what are my options?
