Hi, the cert itself doesn't contain anything re CRLs (including no CRLDP as I just notice). Keying material snipped, otherwise complete (different serial, but generated from the same script): Certificate: Data: Version: 3 (0x2) Serial Number: 256 (0x100) Signature Algorithm: sha512WithRSAEncryption Issuer: C=LU, L=Luxembourg, O=Fondation RESTENA, CN=RESTENA Staff Authentication CA/emailAddress=admin@restena.lu Validity Not Before: Mar 7 09:31:43 2013 GMT Not After : Mar 11 09:31:43 2016 GMT Subject: C=LU, L=Luxembourg, O=Fondation RESTENA, OU=Technical, CN=almostanonymous@restena.lu/emailAddress=almostanonymous@restena.lu Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:b6:60:0a:be:fb:76:d9:8d:7c:c6:c0:a5:d3:95: Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: critical Digital Signature, Key Encipherment, Key Agreement X509v3 Extended Key Usage: TLS Web Client Authentication X509v3 Certificate Policies: Policy: 1.3.6.1.4.1.23735.5.4 CPS: https://www.restena.lu/ca/restena-staffauth-cps.pdf Signature Algorithm: sha512WithRSAEncryption Maybe it's more a problem with the (intermediate) CA's CRL properties in its cert: Certificate: Data: Version: 3 (0x2) Serial Number: 256 (0x100) Signature Algorithm: sha512WithRSAEncryption Issuer: C=LU, L=Luxembourg, O=Fondation RESTENA, CN=RESTENA Services CA/emailAddress=admin@restena.lu Validity Not Before: Feb 20 08:40:33 2013 GMT Not After : Feb 18 08:40:33 2023 GMT Subject: C=LU, L=Luxembourg, O=Fondation RESTENA, CN=RESTENA Staff Authentication CA/emailAddress=admin@restena.lu Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:a4:b3:da:e4:dc:18:5d:ab:d2:67:7f:e7:d1:29: Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 4A:16:64:64:0B:AF:01:3D:5F:B4:9E:BB:B0:6D:FE:F2:E9:81:60:4D X509v3 Authority Key Identifier: keyid:5F:F5:DB:E2:ED:B1:5A:8A:60:E2:E8:35:BC:85:2F:D3:14:24:7B:80 DirName:/C=LU/L=Luxembourg/O=Fondation RESTENA/CN=RESTENA Services CA/emailAddress=admin@restena.lu serial:A7:0A:8C:94:C4:2D:2D:A8 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Certificate Sign, CRL Sign X509v3 Subject Alternative Name: email:admin@restena.lu X509v3 CRL Distribution Points: Full Name: URI:https://www.restena.lu/ca/restena-root.crl Authority Information Access: CA Issuers - URI:http://www.restena.lu X509v3 Certificate Policies: Policy: 1.3.6.1.4.1.23735.5.1 CPS: https://www.restena.lu/ca/restena-root-cps.pdf Signature Algorithm: sha512WithRSAEncryption But here I only see that the cert can sign CRLs, no other constraints. For amoment I was wondering if it's because the CRL has this extra line: X509v3 Authority Key Identifier: keyid:4A:16:64:64:0B:AF:01:3D:5F:B4:9E:BB:B0:6D:FE:F2:E9:81:60:4D DirName:/C=LU/L=Luxembourg/O=Fondation RESTENA/CN=RESTENA Services CA/emailAddress=admin@restena.lu serial:01:00 which is the DirName of the *root* CA. But the root CA is the ultimate authority, so isn't this the correct thing to state? Commerical CA's CRLs don't seem to include any more than the keyid... Stefan On 10.03.2015 15:35, Adam Bishop wrote:
- gpg control packet On 10 Mar 2015, at 13:47, Stefan Winter <stefan.winter@restena.lu> wrote: So... the smoking gun line is "error 44 : Different CRL scope".
I suspect the issue is with the certificate itself - there are a few x509 extensions that mean a CRL is asserted to only have certificates revoked for certain reasons, or be partitioned into multiple CRL's. In short, I think OpenSSL believes the CRL is incomplete.
What does openssl x509 -noout -text -in <crt> say?
Regards,
Adam Bishop
gpg: 0x6609D460
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66