Here's the scenario.
- Server: Ubuntu 12.04 -- postfix and dovecot
- Client: Ubuntu 13.10 -- offlineimap and msmtp
I'm finishing off my recovery from Heartbleed and want to re-issue my own server certificate. Since it is a private server, I originally created a CA, then used the CA to sign the server certificate. The CA cert is properly installed on my client system, the server key and cert are installed on the server.
Now, I have created a CRL and divined that the CRL need not go on the server (except to distribute far and wide if I had any other users), but does need to be installed on my desktop machine so that OpenSSL won't accept the original key. So, I copied the CRL file into /etc/ssl/crl. I created the link using
ln -s mycrl.pem `openssl crl -hash -noout -in mycrl.pem`.0
The result of that looks reasonable.
openssl s_client connections to the server just fine. No error messages that I can see in the connection, but I expect there to be all kinds of errors and possibly even a refusal to connect. So, I look in my openssl configuration file and move the CRL file to /etc/ssl/crl.pem. Same result:
depth=1 C = US, ST = TX, L = Austin, O = SavanniDGerinel, OU = SavanniDGerinel, CN = SavanniDGerinel CA, name = savannidgerinel.com, emailAddress = email@example.com verify return:1 depth=0 C = US, ST = TX, L = Austin, O = SavanniDGerinel, OU = SavanniDGerinel, CN = apps.savannidgerinel.com, name = savannidgerinel.com, emailAddress = firstname.lastname@example.org verify return:1 --- Certificate chain 0 s:/C=US/ST=TX/L=Austin/O=SavanniDGerinel/OU=SavanniDGerinel/CN=apps.savannidgerinel.com/name=savannidgerinel.com/emailAddressemail@example.com i:/C=US/ST=TX/L=Austin/O=SavanniDGerinel/OU=SavanniDGerinel/CN=SavanniDGerinel CA/name=savannidgerinel.com/emailAddressfirstname.lastname@example.org ... tons more stuff .... SSL-Session: ... tons of sessions stuff ... Verify return code: 0 (ok)
How do I force the OpenSSL system on my laptop to actually pay attention to revocation files? And, given that I'm sure that certificates get revoked regularly, why are there absolutely no other CRL files on my system? How can I be sure that I'm actually connecting to what I think I'm connecting to?
Not to put too fine a point on it, but why is installing a revocation list difficult? This strikes me as the kind of thing that has to be trivial for end users who know nothing in order to ensure internet security.