Globus: GSI v2.0: CRL Support
The Globus Toolkit™ supports CRLs on both the client and server side. CRL support is optional, however if a CRL file is present it must be correctly formatted or it will cause an error to be raised and certificates from CA the CRL is associated with, will not be honored.Contents:
A CRL file should be stored in the trusted certificates directory alongside the file containing the trusted CA certificated it is associated with (normally this is /etc/grid-security/certificates). The filename of the CRL file should be the same basename of the associated CA certificate file, but with a ".r0" extension.
For example if a CA certificate was stored in 42864e48.0 the CRL for that CA should be stored in 42864e48.r0.
CRL Expiration: The Next Update field
Globus treats the "Next Update" field of the CRL as an expiration field. If the time in the Next Update field has past Globus will treat the CRL as invalid and cease to accept certificates issued by the CA associated with the CRL in question.
The CRL should be stored in base-64 encoded PEM. The file should look like the example below. Note that the BEGIN and END lines are significant and must appear exactly as shown. Any text before the BEGIN line or after the END line ignored.
-----BEGIN X509 CRL----- MIIDQTCCAikwDQYJKoZIhvcNAQEFBQAwdTETMBEGCgmSJomT8ixkARkWA25ldDESMBAGCgmSJomT 8ixkARkWAmVzMSAwHgYDVQQLExdDZXJ0aWZpY2F0ZSBBdXRob3JpdGllczEZMBcGA1UECxMQRE9F IFNjaWVuY2UgR3JpZDENMAsGA1UEAxMEcGtpMRcNMDIwNTA5MjAwMjM2WhcNMDIwNjA4MjAwMjM2 WjCCAYEwEgIBXBcNMDIwMzE5MTcyNjI4WjASAgFbFw0wMjAzMTkwMDA0NDJaMBICASUXDTAyMDIx MjIwMTkzMVowEwICAK8XDTAyMDUwNzIzMzAxNFowEgIBUBcNMDIwMzEyMjAzMjM4WjATAgIArhcN MDIwNTA3MjMyMjM5WjASAgFPFw0wMjAzMjcxNDQxMTJaMBICAR4XDTAyMDIwNDIxNTc1MVowEgIB SRcNMDIwMzE0MjI0OTQzWjASAgF2Fw0wMjA0MDgxOTMwMzNaMBMCAgChFw0wMjA0MzAyMDQwMjVa MBICARMXDTAyMDEyOTIwMTQwOFowEwICAKAXDTAyMDQzMDIwNDAyNVowEgIBEhcNMDIwMTI5MTk1 NDIzWjATAgIAmhcNMDIwNTA5MjAwMjM2WjASAgENFw0wMjAxMjgyMzE0NDZaMBICATwXDTAyMDMw NTE5NDExM1owEgIBOBcNMDIwMzE5MjMxOTI5WjASAgE3Fw0wMjAzMDgyMDE4NDhaMA0GCSqGSIb3 DQEBBQUAA4IBAQBWt6fD7AsvcmuTsSx9GWPbFIR3CCG7yIQUDiBSOOJi3guKh4tLqiCIQeIkGbMp 7XeEk+5oKRcuwZdMQpseKO6GYVVACEkqDczk2L62kMiE/7cTbXryKJRg87fGF6MC+uXcU0bTCtpC tByQ82yaKuPw/C+JYOurMzhyc8ZSxzJxz7WKYEiCzig5ZiVBvqO7ksSJGUy08ABWSmPBIL3u3CG6 Lz7aV/GiME20eXQRW++9256NhkT2P2IYETa5c/UFWlwyAFLq23C5u/R5e1sqpK5BcmAPqId957b9 +g7I9/ZsXj1ZRNlEPZ3wu6XHwVpC2TSLG95B+rl0TDNzxEKho1Rc -----END X509 CRL-----