Re: CRL expiration

[Donn Cave <donn@u.washington.edu>]

On Dec 5, 2007, at 2:10 PM, Matt Kelley wrote:

> I am using OpenLDAP 2.3.39.  I have enabled CRL checking by including
> "TLSCRLCheck peer" in my slapd.conf file.  I am having a problem when
> CRLs expire.  I find that, after retrieving an updated CRL, I must
> restart slapd in order for it to be used.  This seems to be true
> whether using TLSCACertificateFile or TLSCACertificatePath.  Is this
> expected?  Is there any way to update CRLs (or certificates, for that
> matter) without recycling slapd?

Yes, if you're willing to modify OpenSSL.  The modification is small,
and you could just link the modified .o file along with the standard
libraries, as long as you don't get too far out of synch with releases.

We aren't that desperate at my site, though.  We will need to restart
the server for a new CRL to take effect.  But we won't need to do this
to survive CRL expiration, because I modified tls.c:tls_verify_cb()
to support expired CRLs.  The expired CRL still works, and in practice
we don't often modify the CRL in a way that matters to anyone.

For more on the OpenSSL part of this, see
http://rt.openssl.org/Ticket/Display.html?id=1424&user=guest&pass=guest

	Donn Cave, donn@u.washington.edu

*** libraries/libldap/tls.c.orig        Fri Aug 31 16:13:56 2007
--- libraries/libldap/tls.c     Wed Dec  5 16:35:23 2007
***************
*** 2544,2549 ****
--- 2544,2553 ----
                        "TLS certificate verification: Error, %s\n",
                        certerr, 0, 0 );
        }
+       if ( !ok && errnum == X509_V_ERR_CRL_HAS_EXPIRED ) {
+               ok = 1;
+               X509_STORE_CTX_set_error( ctx, 0 );
+       }
        if ( sname )
                CRYPTO_free ( sname );
        if ( iname )