Configure certificate revocation

You will need to revoke a certificate if it has been compromised in any way or if an employee leaves your organization.

The following are the methods to revoke a certificate:

Configure Codar to use a Certificate Revocation List

The following is an example of how to revoke a certificate that was generated by the certificate authority and publish a Certificate Revocation List (CRL) that contains this certificate ID in the list. The CRL must already exist. You will download and save it in a folder on the system where Codar is installed and point to its location using the ca-revocation-url parameters.

  1. Copy the CRL file to the system where Codar is installed (for example, copy it to the
    <crl_file_directory> directory).

  2. In the CSA_HOME\jboss-as\standalone\configuration\
    standalone.xml     file, add the ca-revocation-url="<crl_file_directory>" attribute to the <ssl> element.

    For example, change the following from:

    <ssl name="ssl" key-alias="CSA" certificate-key-file="CSA_HOME\
    jboss-as\standalone\configuration\.keystore"
    ca-certificate-file="CSA_JRE_HOME\lib\security\cacerts"
    verify-client="want"/>

    to

    <ssl name="ssl" key-alias="CSA" certificate-key-file="CSA_HOME\
    jboss-as\standalone\configuration\.keystore"
    ca-certificate-file="CSA_JRE_HOME\lib\security\cacerts"
    verify-client="want" ca-revocation-url="<crl_file_directory>” />

  3. Restart Codar service, see Restart Codar.

  4. Log in to the Codar Console using a revoked certificate. The Secure Connection Failed message should display in the browser.

Configure Codar to use Certificate Revocation List Distribution Point

To enable a Certificate Revocation List Distribution Point (CRL DP), do the following:

  1. Edit the CSA_HOME\jboss-as\standalone\configuration\
    standalone.xml     file and enable revocation and CRL DP by adding the following lines under <system-properties>:

    <property name="com.sun.net.ssl.checkRevocation" value="true"/>
    <property name="com.sun.security.enableCRLDP" value="true"/>

  2. Restart Codar service, see Restart Codar.

ConfigureCodar to Use Online Certificate Status Protocol

To enable the Online Certificate Status Protocol (OCSP), complete the following steps:

  1. Edit the CSA_HOME\jboss-as\standalone\configuration\
    standalone.xml     file and enable revocation by adding the following line under <system‑properties>:

    <property name="com.sun.net.ssl.checkRevocation" value="true"/>

  2. Edit the CSA_JRE_HOME\lib\security\java.security file and uncomment the following line:

    ocsp.enable=true

  3. Restart Codar service, see Restart Codar.

Send Help Center feedback