You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There are 3 different ways of checking the revocation status of a certificate inside the WildFly project. These are:
Certificate Revocation List(s): where a file includes a list of all the certificates that are considered revoked. WildFly supports multiple lists for both the client and the server, which WildFly can use to check the revocation status of when authentication another party.
Client side OCSP: where the party receiving a certificate can communicate with an OCSP responder to query the status directly. This can also be configured for both a server and a client.
OCSP Stapling: where the server pre-emptively attaches the revocation status of its certificate chain as a part of the handshake message. The client receiving this header can choose to accept it, or fall back to OCSP or CRL if the status is not available.
This blogpost with explain each of these methods and their use cases and when and where they should be used, along with the perks of using them.
There are 3 different ways of checking the revocation status of a certificate inside the WildFly project. These are:
This blogpost with explain each of these methods and their use cases and when and where they should be used, along with the perks of using them.
Note: support for OCSP stapling is still underway and can be tracked through the following issues:
https://issues.redhat.com/browse/ELY-434
https://issues.redhat.com/browse/WFCORE-6802
A guide to demonstrate how to use OCSP Stapling can be found here: wildfly-security/wildfly-elytron#2173
A guide to demonstrate how to use CRLs can be found here: https://wildfly-security.github.io/wildfly-elytron/blog/ssl-certificate-revocation-list/
There is no guide to using client side OCSP, however, the analysis doc for this RFE can be found here: https://docs.wildfly.org/wildfly-proposals/elytron/WFCORE-3947-ocsp-ssl-revocation.html
The text was updated successfully, but these errors were encountered: