Configure CAC Support with Multiple CRL Files

The UCMDB Browser can accept multiple CRL files. However, Tomcat only supports a single CRL file via the crlFile Connector attribute. The following procedure highlights how to work around this Tomcat limitation so that the UCMDB Browser can use multiple CRL files:

1. Convert the CRL files from DER format to PEM format by using the following OpenSSL command (DER format is binary and PEM format is Base64-encoded text). Make sure that the CRL file name does not contain any space, because OpenSSL does not work well with spaces in file names.

   OpenSSL crl –inform DER –in <input path to CRL file> -outform PEM –out <output path to CRL in PEM format>

2. Concatenate the contents of all PEM-formatted files in a proper order into a new file. The content from Trust Anchor must be the first in the new file.
3. Update server.xml to reference the new file in the crlFile attribute.

The following example demonstrates how to perform the above procedure for two CRL files under the test64 folder:

1. Convert the CRL file format by using the following commands:

   OpenSSL crl –inform DER –in c:/certs/test64/TrustAnchorCRLCP.01.01.crl -outform PEM –out c:/certs/test64/TrustAnchor.pem
   OpenSSL crl –inform DER –in c:/certs/test64/IntermediateCRLRL.02.01.crl -outform PEM –out c:/certs/test64/Intermediate.pem
   

2. Open TrustAnchor.pem and Intermediate.pem in a text editor.

3. Copy the entire contents of Intermediate.pem, and then paste the content at the bottom of TrustAnchor.pem, as shown below.

   -----BEGIN X509 CRL-----
   MIIBbzCB2QIBATANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJVUzEYMBYGA1UE ChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb0QxEDAOBgNVBAsTB1Rlc3Rp bmcxFTATBgNVBAMTDFRydXN0IEFuY2hvchcNOTkwMTAxMTIwMTAwWhcNNDgwMTAx MTIwMTAwWjAiMCACAScXDTk5MDEwMTEyMDAwMFowDDAKBgNVHRUEAwoBAaAjMCEw CgYDVR0UBAMCAQEwEwYDVR0jBAwwCoAIq5rr+cLnVI8wDQYJKoZIhvcNAQEFBQAD gYEAC7lqZwejJRW7QvzH11/7cYcL3racgMxH3PSU/ufvyLk7ahR++RtHary/WeCv RdyznLiIOA8ZBiguWtVPqsNysNn7WLofQIVa+/TD3T+lece4e1NwGQvj5Q+e2wRt GXg+gCuTjTKUFfKRnWz7O7RyiJKKim0jtAF4RkCpLebNChY=
   -----END X509 CRL-----
   -----BEGIN X509 CRL-----
   MIIBSzCBtQIBATANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJVUzEYMBYGA1UE ChMPVS5TLiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb2QxEDAOBgNVBAsTB1Rlc3Rp bmcxFTATBgNVBAMTDENBMS1STC4wMi4wMRcNOTkwMTAxMTIwMTAwWhcNNDgwMTAx MTIwMTAwWqAjMCEwCgYDVR0UBAMCAQEwEwYDVR0jBAwwCoAIZdDTuqICq/YwDQYJ KoZIhvcNAQEFBQADgYEAxrDHzKno1mkJqPTub0c9To6jC3CGTilV1E12oD0kFjkX qL40+W251qQ2wMC+G7ZrzBIc5dRuJ93feHZ7cc03/s3TziXDvSyfNOYpHzkPwT48 HuSgBYgJ3uswwk+tDiA64NzbOJqssxxhFRok9OpwC8eQkzgpA3a6816v2I3XL9s=
   -----END X509 CRL-----

4. Save the concatenated contents to a new file. For example, TrustInt64.pem.

5. Modify the server.xml file so that the crlFile attribute points to this new file:

   crlFile="C:/certs/test64/TrustInt64.pem"

6. Save the server.xml file, and then restart the Tomcat server.