CAcert System Admins discussion list

[Jan Dittberner <jandd AT cacert.org>]

On Mon, May 21, 2012 at 05:12:50PM +0200, Michael Tänzer wrote:
> Hi Guys,
> 
> Michael Ionescu recently made me aware of a serious issue with our
> client cert enabled services. On almost all services we do not have
> revocation checking enabled which is kind of like a password users are
> not allowed to change even if they know it got into the wrong hands.
> 
> I have extended the documentation on our Wiki to cover how to enable
> revocation checking with Apache versions < 2.3:
> https://wiki.cacert.org/ApacheServerClientCertificateAuthentication#Revoked_Certificate_Checking
> 
> Please adjust the configuration of your servers accordingly. If there is
> some problem because your host can't connect to https://crl.cacert.org/
> there's probably a restriction in the firewall. In that case contact
> Mario, I'm sure he can help you out there.

I just added a appropriate firewall rule on infra01 to allow the LXC
containers to reach crl.cacert.org on port 443.

CRL checks are now enabled on svn.cacert.org.


Best regards
Jan

-- 
Jan Dittberner - CAcert Infrastructure Team
Software Architect, Debian Developer
GPG-key: 4096R/558FB8DD 2009-05-10
         B2FF 1D95 CE8F 7A22 DF4C  F09B A73E 0055 558F B8DD
http://www.dittberner.info/

Attachment: smime.p7s
Description: S/MIME cryptographic signature