What I had to do was sent the depth to the number or greater than the
number of ca's and I had to get all the crl's for each CA and concat
into a crl file.



On 14 October 2016 at 16:49, Zeal Vora <zeal@freecharge.com> wrote:
> Thanks Maxim.
>
> I tried changing the ssl_verify_depth to 1 from value of 2 however still I
> get 400 Bad Request for all the certificates ( Valid and Revoked ).
>
> I checked the error_log file, there are no entries in that file. It all
> works when I remove the ssl_crl option ( however then revoked certificates
> are allowed ).
>
> Just for bit more info, I downloaded the CRL from ADCS which is in form of
> test.crl which I convert it to .pem format with openssl.
>
>
>
>
> On Thu, Oct 13, 2016 at 6:27 PM, Maxim Dounin <mdounin@mdounin.ru> wrote:
>>
>> Hello!
>>
>> On Thu, Oct 13, 2016 at 03:07:25PM +0530, Zeal Vora wrote:
>>
>> > Hi
>> >
>> > We've implemented basic Certificate Based Authentication for Nginx.
>> >
>> > However whenever the certificate is revoked, Nginx still allows the
>> > client
>> > ( with revoked certificate ) to access the website.
>> >
>> > I verified manually with openssl with OCSP URI and OCSP seems to be
>> > working
>> > properly. Nginx doesn't seem to be forwarding request to OCSP before
>> > allowing client.
>>
>> That's because nginx doesn't support OCSP validation of client
>> certificates. Use CRLs instead.
>>
>> > I tried to specify the ssl_crl but as soon as I put it, all the clients
>> > starts to receive 400 Bad Request.
>> >
>> > Here is my sample relevant Nginx Config :-
>> >
>> >
>> > ### SSL cert files ###
>> >
>> > ssl_client_certificate /test/ca.crt;
>> > ssl_verify_client optional;
>> >
>> > ssl_crl /prod-adcs/latest.pem;
>> > ssl_verify_depth 2;
>> >
>> >
>> > Is there something that I'm missing here ?
>>
>> Your error log should have details. Given you are using verify
>> depth set to 2, most likely there is no CRL for the root
>> certificate itself, and that's why nginx complaining.
>>
>> --
>> Maxim Dounin
>> http://nginx.org/
>>
>> _______________________________________________
>> nginx mailing list
>> nginx@nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx
>
>
>
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx