Support for crlDistributionPoints?

[ProbablyRusty]

Is there a way to specify crlDistributionPoints in easyrsa?

[ecrist]

This is not, currently.

[marcoslois]

I think it's already included, if take a look at x509-types dir you can attach this info to all types or to specific ones adding required extensions:

authorityInfoAccess     = caIssuers;URI:http://example.com/ca.crt,OCSP;URI:http://ocsp.example.com
crlDistributionPoints   = URI:http://example.com/ca.crl

You can add other extensions also.

[viharm]

Yes, I was concerned about this too. However based on the comment by @marcoslois , I tried with a simple start.

I added the following line to .../EasyRSA/IntCA/x509-types/server

crlDistributionPoints = URI:http://ca.domain.tld/crl.pem

All certificates issued since, have this CRL distribution point (obfuscated) in it.

I have however revoked a test certificate and placed the new CRL at the above CDP, but somehow both Firefox and curl still accept it. Not sure how to test a revoked certificate.

[viharm]

Just noticed a very good explanation in #15 here #15 (comment).

There is already built-in support for CDP. Simple uncomment this line

easy-rsa/easyrsa3/x509-types/COMMON

Line 7 in 19a2004

#crlDistributionPoints = URI:http://example.net/pki/my_ca.crl

and change the URL to point to your CDP.

No need to specifically add the line to the server configuration as this applies to all certificates issued - awesome!

Shouldn't this issue be closed?

[jasonhe54]

There is already built-in support for CDP. Simple uncomment this line

How do I go about doing this? Seems like the x509-types folder is owned by root, so it seems like I can't modify it

[TinCanTech]

@jasonhe54 current git/master/easyrsa will copy those files to your PKI for use.

Try:

easyrsa show-ca

Should copy the files.

[TinCanTech]

Personally, editing COMMON seems like the most obvious solution.

A command line option is less reliable ..