You can configure Activator to compare certificates against lists of invalid certificates that are maintained by the issuing certificate authorities. This checking is done for outbound encrypted documents and inbound signed documents.
A certificate revocation list (CRL) is a list of third-party certificates that are no longer valid. Certificate authorities maintain such lists of certificates they issued but later invalidated for one reason or another. CRLs are accessible on the Internet, and you need an Internet connection to use them.
The Activator always attempts to do CRL checking for each traded message. Whether it succeeds in the attempt, and whether it fails a message with a revoked certificate, depends on whether a CRL is available to check a certificate against. CRL checking is only attempted for CA-issued certificates, never for self-signed certificates.
A certificate is checked if a CRL can be obtained from a CA. If there is a CRL for a given certificate, that CRL is issued and signed by the same issuer as the certificate. The CRL may have been downloaded from a distribution point that matches one specified in a CRL distribution point extension in the certificate. Most CRLs have a thisUpdate time indicating when the CRL was last updated by its issuer. Most also have a nextUpdate time indicating when the issuer next updates the CRL. A CRL may be updated before its nextUpdate time.
As an example of CRL checking, when a partner sends you an encrypted document, Activator checks the certificate associated with the inbound document against the appropriate CRL. If the certificate is on the CRL, Activator fails the inbound document.
Activator checks a specific certificate only against the appropriate CRL. For example, Activator does not check a certificate issued by VeriSign against a CRL issued by GlobalSign.
Although using CRLs can enhance security, the checking process can result in longer processing times. Consequently, your decision whether to use CRLs should weigh the security advantage against the performance handicap.
Activator usually checks a certificate against a previously downloaded CRL. But this can be extended to on-the-fly CRL downloading and checking by selecting the check box for Automatically retrieve CRLs on the CRL usage and retrieval configuration page (see Advanced CRL settings). With this enabled, Activator looks for a CRL distribution point URL in the certificate being checked and downloads the updated CRL if available. It then checks the certificate against the newly downloaded CRL. If an updated CRL is not available, Activator checks the certificate against the previously downloaded CRL. Because of this on-the-fly downloading and checking capability, there can be multiple CRLs from the same issuer.
You are responsible for obtaining from the certificate authority the information required for accessing the CRL. Activator downloads the latest CRL before performing certificate checks. It also can download updates of the CRL, based on the update interval in the previously downloaded CRL.
CRL checking is potentially performed for every non-root certificate encountered during certificate path validation. The following steps are taken for each such certificate.
Before you can download a CRL to Activator, you must obtain the information required to access the CA’s CRL.
CRLs are usually made available via one of three protocols: HTTP, HTTP/S, and Lightweight Directory Access Protocol (LDAP). For example, VeriSign CRLs are accessed via HTTP and Entrust CRLs are accessed via LDAP.
You can obtain the CRL information by viewing the details of a CA-issued certificate. See Details tab. The information, if present, is labeled as a CRL distribution point.
The following URL is an example of the CRL distribution point specified in a VeriSign certificate:
http://crl.verisign.com/class1.crl
You would enter this URL to add a VeriSign CRL to Activator.
Use this procedure to download a CRL.
common\conf\crls. Once a subdirectory reaches the maximum CRL file limit, the server creates another subdirectory and begins storing additional CRLs in the new folder. This is intended as an aide to users who may have thousands of CRL files. By default, the maximum limit for each subdirectory is 500 files.Once one or more CRLs have been downloaded, you can use the CRL list page to manage them. To open this page:
The CRLs page shows the name of each CRL, the date and time the CRL was last updated, the update schedule status, and the download status.
On this page you can click the URL of a CRL and open another page that lets you change the URL for downloading the CRL or the updating interval. You also can view details of the CRL.
To delete a CRL, click Delete to the right of a CRL on the CRL list page or click Delete this CRL on the manage CRL page. Deleted CRLs no longer appear on the CRL list page and are deleted from <install directory>\common\conf\crls.
Use the CRL usage and retrieval configuration page to control how CRLs are used and updated in Activator.
In most cases the default settings on this page are adequate. You may want to change settings for special requirements. When the default values are used and no current CRLs are in <install directory>\common\conf\crls, CRL checking does not occur.
To open the CRL usage and retrieval configuration page:
Require CRLs
Select this to mandate CRL checking for all non-root (not self-signed) certificates and to fail certificate path validation when Activator cannot find a certificate's CRL. In most cases, Require CRLs is turned off by default.
When Require CRLs is turned off and a CRL cannot be found for a certificate, the certificate is presumed valid and certificate path validation continues.
When Require CRLs is turned on, Activator must find a CRL for each non-root certificate. If a CRL is not found, the certificate is considered revoked and the certificate path validation fails.
When selected, make sure update schedules are set on the manage CRL page for all CRLs needed to check non-root and intermediary certificates in the certificate path.
Use expired CRLs
Select this option to enable the use of an expired CRL when Activator cannot find a current CRL in <install directory>\common\conf\crls. Activator looks for a current CRL with the same issuer name as the certificate being checked. In a current CRL, the current time stamp is between the CRL's thisUpdate and nextUpdate time stamps. If Activator cannot find such a CRL, it looks for a CRL with the same issuer name as the certificate and with a nextUpdate time stamp that is before the current time stamp. If more than one such expired CRL is found, the most recently expired CRL is used to check whether the certificate has been revoked. Clear the check box to use only CRLs that have not expired. Use expired CRLs s turned off by default.
Automatically retrieve CRLs
Select this option to automatically retrieve CRLs using the information in certificates' CRL distribution points extension. When this option is selected and Activator does not already have an effective CRL for a certificate, it attempts to use the certificate's CRL distribution point extension to retrieve the CRL for that certificate.
If Activator fails to retrieve a CRL and the Require CRLs option is selected, Activator will fail to validate the certificate. In most cases, Automatically retrieve CRLs is turned off by default.
Proxy mode for HTTP/HTTPS CRL retrieval
The Trusted roots certificates tab displays the roots of partners certificates that a community trusts. In the case of a self-signed certificate, the trust is for the certificate itself, as a self-signed certificate is a root certificate. In the case of a certificate authority certificate, the trust is for the root certificate in the chain of trust of a partner’s certificate. By default, the system trusts root certificates when end-entity partner certificates are imported.
As CRLs are used, they are cached in memory. The CRL cache is implemented as a bounded most recently used (MRU) cache. The cache grows to a maximum number of entries, after which the least recently used entry is removed to make room for the addition of a new entry. Every time an entry is added or used, it is moved to the top of the list of most recently used entries.
The default maximum size for the CRL cache is 150 entries.
Every node in Activator maintains its own CRL cache according to what CRLs are used by that node.
..\tools>crlPurgeHttpsClient http 127.0.0.1 6080 api-user test
|