dynamic CRL

[Travis Dimmig]

> Travis Dimmig wrote:
> > Apologies ahead of time if this information is easily available
> > somewhere else, but everything I found seemed to be a few years out of
> > date.  Does freeRadius now have the ability to re-read a certificate
> > revocation list, or does it still require a restart after additions to
> > the CRL?
> 
>   FreeRADIUS uses OpenSSL for all SSL related things.  OpenSSL doesn't re-
> load CRLs dynamically.
> 
>   Alan DeKok.
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html

OpenSSL does provide a way of outputting the crl to a pem file, though, for instance.  Would it not be possible to point freeRadius to such a file and have it either monitor for changes or re-read when attempting a certificate based authentication?  A user would be responsible for re-generating that file when a new certificate is revoked, but freeRadius would not have to be restarted.

If this question is off the mark, it is probably because I don't know how freeRadius interacts with OpenSSL for certification validation.  Can you explain to me how freeRadius currently checks if a certificate is valid or revoked?

Travis