View source for UniServer CA2: Client Certificates Revocation

{{Uc nav UniServer CA2}}
'''Portable CA - Client Certificates Revocation'''

When a personal (client) certificate for whatever reason becomes compromised it needs to be revoked. In addition we also need to inform Apache to prevent access to the server for revoked certificates.

== Revocation overview ==
The revocation process has been semi-automated with '''Revoke.bat''' the following provides an overview of this process.   

==== Serial number ====
OpenSSL stores a list of issued certificates in file '''index.txt''' (text file database), open this file, find the serial number of the certificate you want to revoke and run the following command.
{|
|-
|
<pre>
openssl ca -config openssl.cnf  -revoke newcerts/<serial-number>.pem
</pre>
|}
This command marks the certificate entry in index.txt as revoked.

Note: You are requested to enter the CA's pass phrase.

==== Certificate Revocation List List ====
To create a certificate revocation list run the following command:
{|
|-
|
<pre>
openssl ca -config openssl.cnf -gencrl -crlexts crl_ext -md sha1 -out crl/crl.pem
</pre>
|}
It scans the database text file '''index.txt''' for all revoked certificates and creates a revocation file '''crl.pem'''

Note 1: You are requested to enter the CA's pass phrase.

Note 2: The control list '''crl.pem''' is saved to folder UniServer\plugins\UniServer_CA\CA\'''crl'''

==== Apache configuration ====
Every time a new control list is generated it needs to be copied over to the server. Although it can be located in any folder I use folder UniServer\usr\local\apache2\conf\'''ssl.crt'''

Apache needs to be informed you are using a control list file and where to find it. 

Edit file UniServer\usr\local\apache2\conf\'''ssl.conf''' add the following line:
{|
|-
|
<pre>
SSLCARevocationFile /usr/local/apache2/conf/ssl.crt/crl.pem
</pre>
|}
Locate it just below CA plugin option as shown below:
{|
|-
|
<pre>
#==  CA plugin option. Certificate Authority (CA):
SSLCACertificateFile /usr/local/apache2/conf/ssl.crt/ca.crt

#==  CA plugin option. Control list:
SSLCARevocationFile /usr/local/apache2/conf/ssl.crt/crl.pem
</pre>
|}
Note: For the new configuration to be picked-up by Apache restart servers .

That covers the background '''Revoke.bat''' automates the above SSL commands.

'''''[[#top | Top]]'''''

== Run Revoke.bat ==
Revoking a certificate is straight forward. On the previous page we created a certificate for Mr X we will revoke this certificate denying that user access to the server.

# Run '''Revoke.bat'''
# Press enter displays a list of issued certificates
# Search down the list for Mr X note the '''serial number''' (in this example is 02) 
# Enter the serial number (02) Note if the list is long you need to scroll down to the input field
# You will be prompted for the CA's '''pass phrase''' (fred) enter this. <br>The certificate is revoked and confirmed.
# You are prompted again for the CA's '''pass phrase''' (fred) enter this.<br>The control list is created.

'''''Note'':''' You are either informed the file '''crl.pem''' was copied to the server or instructed to manually copy the file to the server.
 
* To manually copy the file:
* Copy file UniServer_CA\CA\crl\'''crl.pem'''
* To folder: UniServer\usr\local\apache2\conf\'''ssl.crt'''

'''''[[#top | Top]]'''''
=== Testing ===
On the previous page we allowed Mr X access to the '''test''' folder (UniServer\udrive\ssl\'''test''').

To confirm that Mr X's certificate has been revoked perform the following test:

# Start servers
# Access page (index.php) by typing '''<nowiki>https://localhost/test/</nowiki>''' into your browser 
# Browser (Firefox) displays: ''SSL peer rejected your certificate as revoked''.

Confirms that Mr X cannot now access the secure folder.

'''''[[#top | Top]]'''''

== Summary ==
This page concludes how to use UniServer portable CA. I have show how easy it is to revoke a personal (client) certificate. 

Make sure you do not revoke certificate with serial 01 otherwise you kill the server certificate.

Remainder of this write-up looks at the batch files used see [[UniServer CA2: Batch File Details | next page]].  

'''''[[#top | Top]]'''''
----

[[Category: Uniform Server 5.0-Nano]]