[Date Prev][Date Next] [Chronological] [Thread] [Top]

Using CRLs

To: "openldap-techn." <openldap-technical@openldap.org>
Subject: Using CRLs
From: Frank Crow <fjcrow2008@gmail.com>
Date: Tue, 2 May 2017 09:51:57 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=0Oc1xx25jpalJPj8FBU/NKb8Xzgqro4/xgo98DKJFjY=; b=Xk1ZXK2wG1CpFx5fN+zf0UgifbCMVkuC39JOCw0kB3D9vvuGqqKP/pL2NQQwA/uyTG wzSOjt1GJtxbwL+qMsRVCwShyB4XnYmc+96wpWmJ/FQHqxfkWjSeZpjMgWl+ybqKASz7 vm+TWOrMzv5jX5YQzwV82Em2k5ycf2gZ8T+2YGSdjypbsA9koPfX9Iu1r3uTVITMF7nV uLC+AnhH4zBsVa64a1u/hnQwAF0TyCIdcH+iYrHQbywreBw6eFkPmaX5r+YKdAcr+XmO mf060C7cwI34I3XRJJebkxcWKe9I401hMW6Pb1uTV07f22UhGoJAYeyVUmIlEtq4sF89 NYxg==

Is it possible to configure OpenLDAP to trust all certs for validity but then also check a CRL to see if the certificate may have been revoked (to reject it)?

Sounds crazy to me and I highly doubt it but I'm asking because somebody handing us requirements is convinced that it is possible to not have connectivity to a CA, and validate a user cert for login using only a CRL.

Does that make any sense at all?

Thanks,

Frank

Follow-Ups:
- Re: Using CRLs
  - From: Michael Ströder <michael@stroeder.com>

Prev by Date: Re: password change interception overlay
Next by Date: Re: Multi Master replication with many 'nonpresent_callback' lines
Index(es):
- Chronological
- Thread