certificate revocation check for PKINIT in KDC

[Greg Hudson]

On 08/08/2017 02:11 PM, Jim Shi wrote:
> Is there any document how to configure certificate revocation check for PKINIT in KDC?

I believe the only documentation we have for this is in the man page for
kdc.conf, which says:

pkinit_revoke
  Specifies the location of Certificate Revocation List (CRL)
  information to be used by the KDC when verifying the validity of
  client certificates. This option may be specified multiple times.

The CRL file(s) have to be maintained out of band (we do not have OCSP
support; you might see documentation for a pkinit_kdc_ocsp variable but
it isn't implemented).  If I read the code correctly, CRL files are only
read on KDC startup, so the KDC must be restarted to update revoked
certs.  CRL files are expected to be in PEM format.