Revoke a certificate authority

Edit online

The Manager supports both Online Certificate Status Protocol (OCSP) and dynamic Certificate Revocation Lists (CRL) as mechanisms to determine whether a signed and otherwise valid client certificate is revoked.

OCSP is an online protocol for doing revocation checking of a single certificate at a time. Conceptually, upon receiving the client certificate as part of the SSL handshake, the Manager determines the OCSP responder URL from the certificate and then query the target OCSP Responder to ask "is this certificate revoked?", to which the OCSP responder responds with either a "yes" or "no".

CRLs are typically published once per day or once per week by the certificate authority. When the Manager receives a client certificate as part of an SSL handshake, it determines the CRL distribution point's URL from the certificate and downloads the CRL from the URL. The CRL contains a list of all the revoked certificates and the manager checks to see whether the current client certificate is in this list. If the certificate is found to be within that CRL, then validation of the certificate fails. It can take up to 1 hour before revoked certificate information is available in the Manager.

Note: This check occurs during the initial handshake of the TLS connection setup or authentication. If the certificate is revoked later during the life of the connection, this revocation is not detected. However, if you configured the Accesser® application library to use TLS, and devices are configured to use TLS for outgoing connections via the configuration option within the Manager, then for the life of the TLS connection, the certificate revocation list is retrieved on a periodic basis and the certificate of the remote party is re-validated. If the other party's certificate is found to be revoked, then the TLS connection is disconnected.

The main advantage of OCSP over CRL is in the efficiency of being to get the status of a single certificate at a time. For PKI systems that contain many revoked certificates, the size of a CRL can grow large resulting in inefficiencies when it comes to transferring over the network, holding in memory, or iterating through to determine whether a certificate is in the list of revoked certificates.

Both OCSP and CRL are supported for users who are logged in to the Manager UI / API. The Accesser HTTPS interface supports client certificate authentication as well, but is not a standard authentication mechanism in S3. The Accesser HTTPS interface supports revocation checks that use CRLs but does not support OCSP.

Note: OCSP Stapling is not supported in the current implementation.