[strongSwan] Problems with CRLs
Sven Anders
anders at anduras.de
Thu Sep 13 10:42:34 CEST 2018
Hello!
can nobody help me with this issue?
Or isn't the question worth it?
Regards
Sven
Am 27.08.18 um 23:32 schrieb Sven Anders:
> Am 22.08.2018 um 17:48 schrieb Sven Anders:
>> Hello!
>>
>> We are experiencing two problems when using CRLs.
>> Our Linux systems runs strongSwan 5.6.2.
>>
>>
>> 1) Because we want a hourly update of CRLs and the standard CRLs timeout
>> is 7 days, we created a cronjob, that fetches the latest CRL every hour.
>>
>> This CRL file is named:
>>
>> /etc/ipsec.d/crls/COMPANY-SUB-CA01.crl
>>
>> For a test, I additionally enabled CRL caching, but this did not
>> make any difference:
>>
>> charon {
>> cache_crls = yes
>> }
>>
>>
>> Here is the problematic run:
>>
>> Aug 22 16:54:44 2101120420063 charon: 15510[CFG] rereading crls from '/etc/ipsec.d/crls'
>> Aug 22 16:54:44 2101120420063 charon: 15510[CFG] loaded crl from '/etc/ipsec.d/crls/0dff165cefbd2ddfb18f27e9215a4897b79f3008.crl'
>> Aug 22 16:54:44 2101120420063 charon: 15510[LIB] crl #75 is not newer - existing crl #75 retained
>> Aug 22 16:54:44 2101120420063 charon: 15510[CFG] loaded crl from '/etc/ipsec.d/crls/2d07eba139f0caad8a5ef7b87d542c46bbcd48ab.crl'
>> Aug 22 16:54:44 2101120420063 charon: 15510[LIB] crl #02 is not newer - existing crl #02 retained
>> Aug 22 16:54:44 2101120420063 charon: 15510[CFG] loaded crl from '/etc/ipsec.d/crls/48db6c1436fcdce1dc14b91619344b669e4dee6c.crl'
>> Aug 22 16:54:44 2101120420063 charon: 15510[LIB] crl #01:62:32 is not newer - existing crl #01:62:32 retained
>> Aug 22 16:54:44 2101120420063 charon: 15510[CFG] loaded crl from '/etc/ipsec.d/crls/COMPANY-SUB-CA01.crl'
>> Aug 22 16:54:44 2101120420063 charon: 15510[LIB] crl #77 is newer - existing crl #75 replaced
>>
>> As you can see here, the manually updated CRL is newer (#77) and strongSwan
>> replaces the old one (#75) by this new version. This seems to be correct.
>>
>> In the new (#77) CRL I have the following entry:
>>
>> Serial Number: 2500000075E60D6340C615C22D000100000075
>> Revocation Date: Aug 22 16:49:00 2018 GMT
>> CRL entry extensions:
>> X509v3 CRL Reason Code:
>> Certificate Hold
>>
>> Now, if I try to connect, I get the following output and the user is accepted.
>> But this is wrong, because the certificate is on hold!
>>
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] crl is valid: until Aug 30 04:58:47 2018
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] using cached crl
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] fetching crl from 'http://ca.company-group.local/CertEnroll/COMPANY-SUB-CA01+.crl' ...
>> Aug 22 16:54:53 2101120420063 charon: 15504[LIB] sending request to 'http://ca.company-group.local/CertEnroll/COMPANY-SUB-CA01+.crl'...
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] fetching crl from 'http://ca.COMPANY.net/CertEnroll/COMPANY-SUB-CA01+.crl' ...
>> Aug 22 16:54:53 2101120420063 charon: 15504[LIB] sending request to 'http://ca.COMPANY.net/CertEnroll/COMPANY-SUB-CA01+.crl'...
>> Aug 22 16:54:53 2101120420063 charon: 15504[LIB] libcurl request failed [60]: SSL certificate problem, verify that the CA cert is OK. Details:
>> Aug 22 16:54:53 2101120420063 charon: 15504[LIB] error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] crl fetching failed
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] certificate status is good
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] certificate "DC=local, DC=company-group, CN=COMPANY-SUB-CA01" key: 4096 bit RSA
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] using trusted ca certificate "CN=COMPANY-ROOT-CA01"
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] checking certificate status of "DC=local, DC=company-group, CN=COMPANY-SUB-CA01"
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] ocsp check skipped, no ocsp found
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] using trusted certificate "CN=COMPANY-ROOT-CA01"
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] crl correctly signed by "CN=COMPANY-ROOT-CA01"
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] crl is valid: until Jun 05 21:52:45 2028
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] using cached crl
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] certificate status is good
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] certificate "CN=COMPANY-ROOT-CA01" key: 4096 bit RSA
>> Aug 22 16:54:53 2101120420063 charon: 15504[CFG] reached self-signed root ca with a path length of 1
>> Aug 22 16:54:53 2101120420063 charon: 15504[IKE] authentication of 'testuser at COMPANY.de' with RSA signature successful
>>
>> If I restart strongSwan the user is denied correctly:
>>
>> certificate was revoked on Aug 22 16:52:00 UTC 2018, reason: certificate hold
>>
>> Where is my fault and can somebody explain it?
>>
>>
>> 2) And we have another problem with delta CRLs:
>>
>> As I understand strongSwan is supporting delta CRLs. The following line in the logfile
>> shows, that strongSwan correctly fetches the (delta) CRL:
>>
>> Aug 22 16:00:53 2101120420063 charon: 30400[CFG] fetching crl from 'http://ca.company-group.local/CertEnroll/COMPANY-SUB-CA01+.crl' ...
>>
>> And the delta CRL has an entry with reason "remove from crl" in it.
>>
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] using trusted certificate "DC=local, DC=company-group, CN=COMPANY-SUB-CA01"
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] crl correctly signed by "DC=local, DC=company-group, CN=COMPANY-SUB-CA01"
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] crl is valid: until Aug 29 04:02:43 2018
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] using cached crl
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] certificate "DC=local, DC=company-group, CN=COMPANY-SUB-CA01" key: 4096 bit RSA
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] using trusted ca certificate "CN=COMPANY-ROOT-CA01"
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] certificate "CN=COMPANY-ROOT-CA01" key: 4096 bit RSA
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] reached self-signed root ca with a path length of 0
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] using trusted certificate "DC=local, DC=company-group, CN=COMPANY-SUB-CA01"
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] crl correctly signed by "DC=local, DC=company-group, CN=COMPANY-SUB-CA01"
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] crl is valid: until Aug 24 04:11:38 2018
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] certificate was revoked on Aug 22 14:01:35 UTC 2018, reason: remove from crl
>> Aug 22 16:01:43 2101120420063 charon: 30400[CFG] using cached crl
>> Aug 22 16:01:43 2101120420063 charon: 30400[IKE] no trusted RSA public key found for 'testuser at COMPANY.de'
>>
>> But as you can see here, the user is denied.
>>
>> What happened here? Is the (delta) reason "remove from crl" misinterpreted as an
>> revocation reason?
>
> I took a look at the sources, but I did not found any special handling of the "Remove from CRL"
> type. It seems to be handled like any other type.
>
> Can anybody confirm this?
>
> Any can somebody explain the first described behaviour, please?
>
>
> Regards
> Sven Anders
--
Sven Anders <anders at anduras.de> () UTF-8 Ribbon Campaign
/\ Support plain text e-mail
ANDURAS intranet security AG
Messestrasse 3 - 94036 Passau - Germany
Web: www.anduras.de - Tel: +49 (0)851-4 90 50-0 - Fax: +49 (0)851-4 90 50-55
Those who would give up essential Liberty, to purchase a little
temporary Safety, deserve neither Liberty nor Safety.
- Benjamin Franklin
More information about the Users
mailing list