EAP-TLS CRL problem - a PKIX guru around?

[Adam Bishop]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10 Mar 2015, at 15:18, Stefan Winter <stefan.winter at restena.lu> wrote:
the cert itself doesn't contain anything re CRLs (including no CRLDP as
I just notice).

I think you're right about the intermediate being the issue... if your leaf doesn't contain a CRL distribution point then openSSL can't be querying it.

I notice that when I'm querying your root CRL, openssl is only returning the first entry. I wonder if it does that when doing an actual validation, as opposed to dumping the CRL.

Also From your root CRL:

            X509v3 Issuing Distrubution Point:
                00...,.*https://www.restena.lu/ca/restena-root.crl

That looks wrong but given OpenSSL is spelling "distribution" wrong this could be a bug in the text output renderer...

Regards,

Adam Bishop
Systems Development Specialist

  gpg: 0x6609D460
    t: +44 (0)1235 822 245
 xmpp: adamb at jabber.dev.ja.net

jisc.ac.uk

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJU/xwOAAoJEKTthRWhpiMvEn4P/03krv2M8xmk8em7kGexnqBH
rbWjfwkhl2vOTttd+DMjD8KDK5FtpC9c2VCyAo/TgiYX+nh/6PVTxwW4K2rgAPBk
XeqdyMIyM92OSH+AZ7kS7nEnQ7yYCU2crLsVqCRoSnOvSHYqwj/vcWPh/Ppj3yN/
86b2NB5Lw5xU50U66U2xixVI1ClvxOjxGz1GXQqe3HSOdLYw0b2XXXo9K6YeyWXo
YkvddCXTpFIN+lHfxDa0w3kg83Sq/lgfnTQJ4jasKn1AQiJwTfvlFzCE8MdjwFUa
7VO3Yj/Q+94jKcZSuizJlbljWdMOh56erKAN4/mx89W4uPTWuFvrgoeWi6VT7vZ2
eQylIRepX5UJCOr1oHEPkm8hHRsJh+UfcEWaozkTfERPu8cHRvVYsMKIzn507Tf9
huW0cCKiJ/mCqEFt7GQtPt56LTA7DeqgXmAjtkxsQ6zikhNH9UQq86LnMWeQdPMM
iipbDTHz8HVBAQM/D4fiwUAvh2U0f4XCvp31Nqg1lnNfdFnmJAIRrzn363s6PRvR
m3ESoSO8r1qYzu1w77MV2By9rLfW05IiBKo6yx/+KBu6ddMbc+LexJiORJ/lou+T
5ZaRwlPY5s5Op8C8TV/TITH4QxlMHWLBXb5rP6ILrh5b6NTX7pW1heS8nXfh3cPD
x1t7abZOZ2Vx7PjrTSde
=uHME
-----END PGP SIGNATURE-----

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.