apache - Apache不检查crl的吊销证书

Closed. This question is off-topic。它当前不接受答案。
                            
                        
                    
                
                            
                                
                
                        
                            
                        
                    
                        
                            想改善这个问题吗？ Update the question，所以它是on-topic，用于堆栈溢出。
                        
                        5年前关闭。
                                                                                            
                
        
我遇到一个我无法真正找到原因的问题。

我出于测试目的在Ubuntu下的VirtualBox中设置了本地CA和Web服务器。

我愿意尝试客户端证书身份验证。

到目前为止，我没有在浏览器中拥有有效证书就无法访问Web服务器。

问题是，吊销证书后，我仍然可以访问服务器。

在我的default-ssl.conf（已加载）中，我设置了：

SSLCARevocationFile to /etc/ssl/CA/crl/crl.pem

使用“ openssl ca -gencrl /etc/ssl/CA/crl/crl.pem”创建“ crl.pem”

openssl crl -in /etc/ssl/CA/crl/crl.pem -text生成以下内容：

Certificate Revocation List (CRL):
        Version 2 (0x1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: /C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
        Last Update: May 29 13:10:55 2014 GMT
        Next Update: Jun 28 13:10:55 2014 GMT
        CRL extensions:
            X509v3 CRL Number:
                4106
Revoked Certificates:
    Serial Number: 01
        Revocation Date: May 29 10:35:53 2014 GMT
    Serial Number: 02
        Revocation Date: May 29 00:32:33 2014 GMT
    Signature Algorithm: sha256WithRSAEncryption
         4a:95:31:27:df:2b:d3:5f:91:86:32:18:7e:04:1f:88:99:22:
         2b:d6:03:8d:c6:1d:81:ca:06:a0:c3:c2:cf:fe:cb:8a:ec:f9:
         7f:bb:37:4c:69:70:1e:43:0c:8e:97:89:f7:32:f8:bf:9c:3b:
         fc:b2:25:55:98:a1:fe:7f:fb:ab:79:13:67:d6:75:02:c6:74:
         03:34:bc:f3:df:61:d5:0f:e6:1e:24:8b:e7:b0:17:1b:c4:2f:
         16:56:44:8d:e4:92:1f:48:51:23:a5:1d:54:26:a4:58:6b:4d:
         07:40:bb:48:7f:c1:61:00:55:20:d2:a1:56:f9:38:fa:f9:84:
         de:2a:a5:2a:69:82:d7:8b:35:24:5b:4d:ee:c0:33:7c:b6:d6:
         83:e2:f8:79:76:f9:04:55:80:45:8c:b1:9d:5b:8d:29:65:f9:
         6d:de:d3:d2:53:6e:f0:d2:44:c9:3e:60:ca:67:0f:2b:f9:27:
         0d:36:4b:90:d5:fe:7b:23:74:6b:94:e3:93:ea:4f:90:2b:db:
         c8:96:29:4b:cc:42:f6:31:27:e6:a2:ce:a3:c8:fa:47:74:bd:
         32:51:71:f3:66:fb:2d:76:0f:ca:64:23:55:eb:f8:5e:bc:0d:
         eb:f9:e4:7a:7f:72:be:fd:1a:a7:76:32:5e:0f:21:b9:c7:2a:
         89:ac:53:26
-----BEGIN X509 CRL-----
MIIByTCBsgIBATANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJBVTETMBEGA1UE
CAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
Fw0xNDA1MjkxMzEwNTVaFw0xNDA2MjgxMzEwNTVaMCgwEgIBARcNMTQwNTI5MTAz
NTUzWjASAgECFw0xNDA1MjkwMDMyMzNaoA8wDTALBgNVHRQEBAICEAowDQYJKoZI
hvcNAQELBQADggEBAEqVMSffK9NfkYYyGH4EH4iZIivWA43GHYHKBqDDws/+y4rs
+X+7N0xpcB5DDI6Xifcy+L+cO/yyJVWYof5/+6t5E2fWdQLGdAM0vPPfYdUP5h4k
i+ewFxvELxZWRI3kkh9IUSOlHVQmpFhrTQdAu0h/wWEAVSDSoVb5OPr5hN4qpSpp
gteLNSRbTe7AM3y21oPi+Hl2+QRVgEWMsZ1bjSll+W3e09JTbvDSRMk+YMpnDyv5
Jw02S5DV/nsjdGuU45PqT5Ar28iWKUvMQvYxJ+aizqPI+kd0vTJRcfNm+y12D8pk
I1Xr+F68Dev55Hp/cr79Gqd2Ml4PIbnHKomsUyY=
-----END X509 CRL-----

我尝试了序列号为01和02的两个证书，并且都可以登录。

有人知道问题可能是什么吗？

谢谢 ！

最佳答案

尝试将以下指令放入conf文件（即default-ssl.conf）

SSLCARevocationCheck链

然后停止并启动apache2服务并查看结果。

Supawat P.

关于apache - Apache不检查crl的吊销证书，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/23939112/