#crl — Public Fediverse posts

Revoke a certificate and generate a CRL with OpenSSL: use ca -revoke to mark it in index.txt, then ca -gencrl to produce a signed revocation list with serial numbers and dates. Works on Ubuntu 22.04, Debian 12, RHEL 9. #tls #crl #ValtersIT

https://www.valtersit.com/vault/revoke-certificate-and-generate-crl-with-openssl-27f0c8/

От Root CA до User Authorization в nginx+apache. Часть 2. Отзыв сертификатов, CRL и OCSP

Сертификат скомпрометирован, а срок действия ещё не вышел — как сказать клиентам «больше ему не верьте»? Разбираем оба механизма отзыва, CRL и OCSP: отзыв, генерация и публикация списков, responder, stapling в nginx/apache. С полным справочником всех параметров.

https://habr.com/ru/articles/1051674/

#OpenSSL #PKI #OCSP #CRL #отзыв_сертификатов #X509 #certificate_authority #OCSP_stapling #nginx #информационная_безопасность

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 191050Z 05009KT 010V070 CAVOK 14/04 Q1026 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 191050Z 05009KT 010V070 CAVOK 14/04 Q1026 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

https://www.wacoca.com/games/1340134/ 【クラロワ】ワールドカップ プレイオフ 日本VS韓国 グランドファイナル決勝戦 [日本語] ##GAMING #ClashRoyale #crl #Game #GameNews #games #GamingNews #GamingTrending #TrendingGames #ゲーミング #ゲーム #ゲーム攻略 #ゲーム最新情報 #ドラゴンクエストV天空の花嫁

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 241020Z 15007KT CAVOK 06/02 Q1000 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 241020Z 15007KT CAVOK 06/02 Q1000 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) is “EBCI 291120Z 20013KT 9999 FEW006 BKN010 09/07 Q1008 TEMPO BKN006” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) is “EBCI 251220Z 35004KT 310V020 3200 BR SCT004 OVC006 05/05 Q1006 TEMPO 2500 BR” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

Shower rain on Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 190920Z 20010KT 6000 -RA SCT006 BKN008 04/03 Q1003 TEMPO 4000 RA SHRA” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 121220Z 18011KT CAVOK 14/06 Q1010 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #brusselssouthcharleroiairport #airport #charleroi #brussels #belgium #ebci #crl #metar #aviation #aviationweather #avgeek vl

Aviation weather for Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) is “EBCI 071050Z 26005KT 200V300 9999 BKN012 14/11 Q1027 BECMG BKN015” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vl

Aviation weather for Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) is “EBCI 071050Z 26005KT 200V300 9999 BKN012 14/11 Q1027 BECMG BKN015” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vii3

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 030750Z 18011KT CAVOK 11/05 Q1019 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vii3

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 030750Z 18011KT CAVOK 11/05 Q1019 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vl

https://blog.gslin.org/archives/2025/09/17/12626/lets-encrypt-%e7%9a%84-revoked-isrgrootx1-letsencrypt-org-%e6%b2%92%e6%9c%89%e4%bb%bb%e4%bd%95%e4%b8%bb%e6%b5%81%e7%80%8f%e8%a6%bd%e5%99%a8%e7%9a%84-crl-%e6%9c%89%e6%94%b6%e9%8c%84/

Let's Encrypt 的 revoked-isrgrootx1.letsencrypt.org 沒有任何主流瀏覽器的 CRL 有收錄

#browser #certificate #crl #letsencrypt #revoke #security #ssl #tls

Shower rain on Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 310750Z 19009KT 9999 FEW008 BKN010 BKN016 18/16 Q1009 TEMPO 4500 -SHRA” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vl

Center For Research #Libraries (#CRL) Pilots #AI to Accelerate #Metadata Production https://www.crl.edu/crl-pilots-ai-accelerate-metadata-production

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 290750Z 21008KT CAVOK 14/11 Q1023 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vl

Beautiful weather for takeoff from Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) “EBCI 290720Z 20008KT CAVOK 14/11 Q1023 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vl

My friend pointed out that short-lived #TLS #certificates is a convenient tool for #censorship, because a CA can just return "unknown error, try again later" on a renew attempt in case they were asked to block a specific domain.

Actually, the main reason is that no one wants to deal with #CRL, I guess. OCSP has shown its significant flaws so it's no more recommended to be switched on, and we're returning to revocation lists. Mozilla's CRLite is already implemented in Firefox, but not in small native (i mean, not webapps) applications and utilities.

Offline verification is always a mess, either it's JWT or TLS, but the latter is decentralized (which is good for the web, of course), therefore is much more a mess. #infosec

Aviation weather for Brussels South Charleroi airport in Charleroi and Brussels area (Belgium) is “EBCI 221320Z 34006KT 300V030 9999 FEW022 BKN030 13/06 Q1017 NOSIG” : See what it means on https://www.bigorre.org/aero/meteo/ebci/en #charleroi #brussels #belgium #brusselssouthcharleroiairport #ebci #crl #metar #aviation #aviationweather #avgeek #airport vl

Let's Encrypt 把 CRL 位置加到憑證裡面了

在「Adding CRL URLs to certificates」這邊看到的公告，把 CRL 位置加到憑證裡面了： On March 12, 2025, Let’s Encrypt will start including CRL (Certificate Revocation List) URLs in certificates we issue, in addition to the OCSP URLs we already include. This is part of our previously announced changes to deprecate support for OCSP. CRLs and OCSP are two di…

https://blog.gslin.org/archives/2025/03/27/12324/lets-encrypt-%e6%8a%8a-crl-%e4%bd%8d%e7%bd%ae%e5%8a%a0%e5%88%b0%e6%86%91%e8%ad%89%e8%a3%a1%e9%9d%a2%e4%ba%86/

#authority #ca #certificate #crl #letsencrypt #ocsp #revoke #root #security

A wild one-day strike appears!

It's always a pleasure to be informed less than 24 hours before the flight.

https://www.brussels-charleroi-airport.com/en/action-security-sector-tuesday-22-october-2024

#charleroi #airport #crl #belgium

Keycloak. Мапинг учеток через mTLS c двойной проверкой в kubernetes

Продолжаем с делиться экспертизой отдела Security services infrastructure ( департамент Security Services компании «Лаборатории Касперского» ). В данном посте мы разберем, как легко настроить mTLS, обращаясь к ресурсам в k8s через ingress-контроллер, и подсоединить это все к keycloak. Пост будет полезен тем, кто в своей инфраструктуре использует PKI и, в частности, клиентские сертификаты. Ни для кого не секрет, что для улучшения защиты доступа к веб-ресурсам многие компании используют или начинают использовать mTLS — когда помимо проверки серверного сертификата проверяется сертификат пользователя. В данной статье мы расскажем: Как настроить проверку клиентских сертификатов в k8s на ingress-контроллере. Как передать клиентский сертификат с ingress-контроллера в keycloak с мапингом сертификата к учетной записи Keycloak-a. Как и зачем настраивать перепроверку клиентского сертификата в keycloak. Как проверить отозванные клиентские сертификаты с помощью keycloak и CRL/OCSP. Статья рассчитана на людей, которые ранее были знакомы с IAM и, в частности, с keycloak-ом. Поэтому в этой части не будет «базы» по SAML2, OAuth2/OIDC и в целом по IAM (на Хабре есть хорошие статьи на эту тему). Также для понимания данной статьи необходимы знания базовых абстракций kubernetes и умение читать его манифесты. В ресерче материалов для данного поста и реализации данной технологии на проде принимали участие еще несколько человек. Указать их соавторами на Хабре нет возможности, поэтому озвучу их тут: Ян Краснов, Иван Николаев, Максим Сушков, Иван Кодянов.

https://habr.com/ru/companies/kaspersky/articles/846326/

#keycloak #k8s #mtls #crl #oscp #nginx #x509_v3 #devops #devsecops

OCSP всё?

Google УЦ Let’s Encrypt предупредил , что намерен «как можно скорее» прекратить поддержку протокола проверки статуса TLS-сертификата Online Certificate Status Protocol (OCSP) и впредь поддерживать только Certificate Revocation Lists (CRLs).

https://habr.com/ru/articles/832170/

#TLS #PKI #CRL #OCSP #CA/Browser_Forum

Not the first one talking about it, but yesterday #LetsEncrypt announced to end the #OCSP service - a proposed standard to check the revocation status of #TLS certificates. The service is terminated in favor of certificate revocation lists (#CRL). The latter one was taught during my university degree in #cybersecurity as the recommended solution - yet adoption was sparse back 2 years ago.

My take on this is that in practice few entities, services and software will be affected. The one's who will be affected are probably those with lesser-known and/or slightly exotic setups. Happy to be proven wrong by people who are more familiar with the matter than I am.

Read up on the announcement of Let's Encrypt.

Let's Encrypt transitions revocation program from OCSP to CRL.

Why? Browsers have also switched browser-side checks (back) to CRL, after 10 years trying OCSP. It's all about privacy and performance.

Until recently, your browser had to request data from the CA (eg DigiCert, Sectigo), which means they can know your sites and browsing/device habits. CRL solves this.

https://letsencrypt.org/2022/09/07/new-life-for-crls

via https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls.html

#webperf #LetsEncrypt #OCSP #HTTPS #CRL #TLS