Configuring LDAP based CRL Publishing

Overview

This page describes the process to configure the CA to publish the CRL to an LDAP server.

Configuring CRL Publishing

The CRL publishing configuration is stored in /var/lib/pki/pki-tomcat/ca/conf/CS.cfg.

To configure the LDAP connection:

$ pki-server ca-config-set ca.publish.ldappublish.enable true
$ pki-server ca-config-set ca.publish.ldappublish.ldap.ldapauth.authtype BasicAuth
$ pki-server ca-config-set ca.publish.ldappublish.ldap.ldapauth.bindDN "cn=Directory Manager"
$ pki-server ca-config-set ca.publish.ldappublish.ldap.ldapauth.bindPWPrompt internaldb
$ pki-server ca-config-set ca.publish.ldappublish.ldap.ldapauth.clientCertNickname ""
$ pki-server ca-config-set ca.publish.ldappublish.ldap.ldapconn.host localhost.localdomain
$ pki-server ca-config-set ca.publish.ldappublish.ldap.ldapconn.port 389
$ pki-server ca-config-set ca.publish.ldappublish.ldap.ldapconn.secureConn false

To configure LDAP-based CRL publisher:

$ pki-server ca-config-set ca.publish.publisher.instance.LdapCrlPublisher.crlAttr "certificateRevocationList;binary"
$ pki-server ca-config-set ca.publish.publisher.instance.LdapCrlPublisher.crlObjectClass pkiCA
$ pki-server ca-config-set ca.publish.publisher.instance.LdapCrlPublisher.pluginName LdapCrlPublisher

To configure CRL mapper:

$ pki-server ca-config-set ca.publish.mapper.instance.LdapCrlMap.createCAEntry true
$ pki-server ca-config-set ca.publish.mapper.instance.LdapCrlMap.dnPattern cn=crl,dc=example,dc=com
$ pki-server ca-config-set ca.publish.mapper.instance.LdapCrlMap.pluginName LdapCaSimpleMap

To configure CRL publishing rule:

$ pki-server ca-config-set ca.publish.rule.instance.LdapCrlRule.enable true
$ pki-server ca-config-set ca.publish.rule.instance.LdapCrlRule.mapper LdapCrlMap
$ pki-server ca-config-set ca.publish.rule.instance.LdapCrlRule.pluginName Rule
$ pki-server ca-config-set ca.publish.rule.instance.LdapCrlRule.predicate issuingPointId==MasterCRL
$ pki-server ca-config-set ca.publish.rule.instance.LdapCrlRule.publisher LdapCrlPublisher
$ pki-server ca-config-set ca.publish.rule.instance.LdapCrlRule.type crl

To enable CRL publishing:

$ pki-server ca-config-set ca.publish.enable true

To simplify testing, the buffer size for revocation checking can be set to 0 so that each certificate revocation will take effect immediately:

$ pki-server ca-config-set auths.revocationChecking.bufferSize 0

Also by default the CRL is only updated at scheduled times. To update the CRL immediately on each certificate revocation:

$ pki-server ca-config-set ca.crl.MasterCRL.alwaysUpdate true

Finally, restart the server.

Verification

To retrieve the published CRL:

$ ldapsearch \
    -H ldap://$HOSTNAME:389 \
    -x \
    -D "cn=Directory Manager" \
    -w Secret.123 \
    -b "cn=crl,dc=example,dc=com" \
    -o ldif_wrap=no \
    -t \
    certificateRevocationList
dn: cn=crl,dc=example,dc=com
certificateRevocationList;binary:< file://<path>

To view the published CRL:

$ openssl crl \
    -in <path> \
    -inform DER \
    -text -noout
Certificate Revocation List (CRL):
        Version 2 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = EXAMPLE, OU = pki-tomcat, CN = CA Signing Certificate
        Last Update: Jan 22 00:56:35 2022 GMT
        Next Update: Jan 22 01:00:00 2022 GMT
        CRL extensions:
            X509v3 Authority Key Identifier:
                keyid:6E:27:EA:CC:40:91:88:35:C7:B0:60:45:B3:2C:6A:74:0B:BF:EE:8A

            X509v3 CRL Number:
                2
Revoked Certificates:
    Serial Number: 07
        Revocation Date: Jan 22 00:56:35 2022 GMT
        CRL entry extensions:
            X509v3 CRL Reason Code:
                Certificate Hold
    Signature Algorithm: sha256WithRSAEncryption
         2d:3f:c1:4d:d4:0a:39:a2:bf:ce:bc:12:96:46:b4:c6:c5:8c:
         65:fb:fe:ea:9b:b1:a3:df:7b:a4:b0:57:9d:d8:55:a4:39:b4:
         5a:17:d7:0a:93:4d:7e:0c:0e:da:87:b1:18:5f:21:96:d4:1e:
         c5:3c:ae:07:87:56:e4:30:fc:06:ea:c7:da:61:fd:ea:b6:b1:
         fa:24:bf:54:f0:32:ea:1d:65:91:58:4e:83:fe:50:72:4a:cc:
         37:4b:61:db:43:c9:9b:74:25:e6:64:93:a4:23:02:ba:b9:64:
         4e:99:5f:12:d6:81:d0:bb:52:b7:df:6e:0d:f3:60:98:9a:0f:
         86:e0:da:77:f9:5c:8b:d7:68:92:10:54:cf:10:0b:41:01:e5:
         b9:aa:44:9f:34:bb:18:36:13:5d:4f:02:38:48:24:b2:c2:72:
         60:18:a4:64:65:10:dc:4a:30:ae:71:e6:9b:b4:de:0a:c7:fc:
         4f:a1:d7:68:b6:8b:bf:dd:08:24:ab:8e:28:e8:ef:20:ce:24:
         83:48:65:4f:c2:f0:04:19:08:fd:5b:30:94:b6:d6:71:30:45:
         2d:25:63:5b:e2:7d:bd:f0:c0:2c:1b:f6:da:a6:93:05:21:fd:
         78:ba:a5:a3:ed:88:f5:fb:c9:f0:e5:b0:e3:e9:9a:c0:00:e9:
         44:b2:4a:83