CRL updates not detected automatically
Hello - We are running freeradius on EL7/EL8 machines: freeradius-3.0.13-15.el7.x86_64 freeradius-3.0.20-12.module_el8.6.0+2865+fd6928c8.x86_64 and have just enabled CRL checking with `check_crl = yes` in mods-enabled/eap. We also have a script to update the CRL files - but radiusd seems to require a restart in order to load the new CRL. Is this expected? It seems rather problematic. Our certs directory looks like: lrwxrwxrwx. 1 root root 15 Sep 13 05:05 241bed0c.0 -> ad.nwra.com.crt lrwxrwxrwx. 1 root root 22 Sep 13 05:05 241bed0c.r0 -> ad-AD-SEATTLE01-CA.crl lrwxrwxrwx. 1 root root 10 Sep 13 05:05 599be2cf.0 -> ipa_ca.crt lrwxrwxrwx. 1 root root 7 Sep 13 05:05 599be2cf.r0 -> ipa.crl -rw-r--r--. 1 root radiusd 4850 Sep 19 08:20 ad-AD-SEATTLE01-CA.crl -rw-r-----. 1 root radiusd 2024 Sep 13 05:04 ad.nwra.com.crt -rw-r-----. 1 root radiusd 1276 Sep 13 05:04 ipa_ca.crt -rw-r--r--. 1 root radiusd 1507 Sep 19 08:20 ipa.crl Thanks, Orion -- Orion Poplawski IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion@nwra.com Boulder, CO 80301 https://www.nwra.com/
On Sep 19, 2022, at 11:32 AM, Orion Poplawski <orion@nwra.com> wrote:
We also have a script to update the CRL files - but radiusd seems to require a restart in order to load the new CRL. Is this expected? It seems rather problematic.
Unfortunately, that's how OpenSSL works. If you need dynamic changes, use OCSP. Alan DeKok.
participants (2)
-
Alan DeKok -
Orion Poplawski