Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create a guide explaining the three methods of certificate revocation checking available within WildFly #641

Open
PrarthonaPaul opened this issue Aug 15, 2024 · 0 comments

Comments

@PrarthonaPaul
Copy link

There are 3 different ways of checking the revocation status of a certificate inside the WildFly project. These are:

  1. Certificate Revocation List(s): where a file includes a list of all the certificates that are considered revoked. WildFly supports multiple lists for both the client and the server, which WildFly can use to check the revocation status of when authentication another party.
  2. Client side OCSP: where the party receiving a certificate can communicate with an OCSP responder to query the status directly. This can also be configured for both a server and a client.
  3. OCSP Stapling: where the server pre-emptively attaches the revocation status of its certificate chain as a part of the handshake message. The client receiving this header can choose to accept it, or fall back to OCSP or CRL if the status is not available.

This blogpost with explain each of these methods and their use cases and when and where they should be used, along with the perks of using them.

Note: support for OCSP stapling is still underway and can be tracked through the following issues:
https://issues.redhat.com/browse/ELY-434
https://issues.redhat.com/browse/WFCORE-6802

A guide to demonstrate how to use OCSP Stapling can be found here: wildfly-security/wildfly-elytron#2173
A guide to demonstrate how to use CRLs can be found here: https://wildfly-security.github.io/wildfly-elytron/blog/ssl-certificate-revocation-list/
There is no guide to using client side OCSP, however, the analysis doc for this RFE can be found here: https://docs.wildfly.org/wildfly-proposals/elytron/WFCORE-3947-ocsp-ssl-revocation.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant