35
muokkausta
Muutokset
Siirry navigaatioon
Siirry hakuun
Ak: Uusi sivu: '''Certificate Revocation List''' on varmenteen tilan kyselyyn tarkoitettu yhteyskäytäntö. Sulkulista sivulta löytyy yleisempää tietoa siitä. == Digiviras...
'''Certificate Revocation List''' on [[varmenne|varmenteen]] tilan kyselyyn tarkoitettu yhteyskäytäntö. [[Sulkulista]] sivulta löytyy yleisempää tietoa siitä.
== Digiviraston tarjoamat CRL palvelut ==
Kaikissa dvv:n varmenteissa on mukana tiedot mistä sulkulistat löytyvät. Itse sulkulistoja päivitetään samalla tavalla kuin [[Digivirasto/OCSP|OCSP]] tietojakin.
Eli alla olevissa esimerkeissä näkyy että G1 henkilökorttien '''This Update''' sulkulista on luotu vähän ennen tasatuntia ja G2 henkilökorttien lista vuorostaan pari minuuttia tasatunnin jälkeen.
=== G1: VRK Gov. Root CA ===
Intermediate CA:ssa on ARL (Authority Revocation List) tiedot:
<pre>
openssl x509 -in certs/vrkcqc2.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/arl/vrkroota.crl
...
</pre>
Itse ARL:n voi hakea seuraavasti ja näyttää sen ruudussa:
<pre>
wget -q -O- http://proxy.fineid.fi/arl/vrkroota.crl | openssl crl -inform der -text -noout
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = FI, ST = Finland, O = Vaestorekisterikeskus CA, OU = Certification Authority Services, OU = Varmennepalvelut, CN = VRK Gov. Root CA
Last Update: Dec 4 07:33:15 2020 GMT
Next Update: Dec 4 07:33:15 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:DB:E9:E1:9B:D2:D1:24:0B:FC:AB:E3:A0:67:EA:AE:9C:4B:77:F4:B0
X509v3 Issuing Distribution Point:
Only CA Certificates
X509v3 CRL Number:
36
Revoked Certificates:
Serial Number: 01A657
Revocation Date: May 6 08:23:06 2019 GMT
CRL entry extensions:
X509v3 CRL Reason Code:
Cessation Of Operation
Signature Algorithm: sha256WithRSAEncryption
99:84:81:14:51:0a:e1:fd:e7:68:09:a5:f8:cb:83:88:6a:66:
40:f6:19:b9:26:38:89:e5:63:f3:a5:27:ec:72:63:b0:a2:bb:
92:eb:d1:0b:59:b5:1d:72:1a:b4:57:42:cd:e7:e5:a7:a5:62:
ad:98:11:8e:c8:62:e8:fe:68:0b:76:9d:3e:34:4b:92:4c:c3:
5b:17:68:02:76:fb:80:11:22:fe:40:9d:5d:8f:9f:3a:f4:e0:
15:31:e0:31:51:70:a7:54:05:af:77:14:fe:a8:e4:b0:f7:ec:
56:21:f2:c0:86:37:7d:8e:1a:f1:91:57:53:5f:cb:9f:57:57:
8d:d2:6f:fe:6b:bf:64:4f:b8:64:c5:13:0f:f0:01:d1:33:b7:
ad:16:d7:62:ce:35:8f:1d:71:40:35:7d:36:94:11:08:dd:89:
74:74:63:77:41:cc:57:e3:c0:4d:89:8c:16:5f:0b:00:a5:1f:
c1:4e:f8:ca:c8:81:72:d8:48:74:b2:7a:68:ad:43:7e:c9:e9:
9d:ce:f6:e9:f3:90:d5:56:81:ee:9d:77:50:51:5f:f0:be:d3:
32:40:ca:38:ee:80:be:b0:f7:cf:4c:9a:de:28:b4:0f:38:f5:
23:3f:6f:60:fa:06:00:9c:f4:70:02:23:61:9a:e4:cb:c3:41:
cc:f8:54:a6
</pre>
Vastaavat tiedot henkilövarmenteesta:
<pre>
openssl x509 -in certs/cert1.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/crl/vrkcqc2c.crl
...
</pre>
Ja CRL:n voi hakea ja näyttää siitä alusta ensimmäiset 20 riviä:
<pre>
wget -q -O- http://proxy.fineid.fi/crl/vrkcqc2c.crl | openssl crl -inform der -text -noout | head -20
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = FI, O = Vaestorekisterikeskus CA, OU = Valtion kansalaisvarmenteet, CN = VRK Gov. CA for Citizen Qualified Certificates - G2
Last Update: Mar 17 18:59:13 2021 GMT
Next Update: Mar 18 02:59:13 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:C1:AF:1D:8A:5F:1D:9A:87:0D:82:10:FC:9D:DD:F5:B0:1E:70:D3:B5
X509v3 CRL Number:
64641
Revoked Certificates:
Serial Number: 3BB94E81
Revocation Date: Dec 23 12:25:27 2016 GMT
Serial Number: 3BB94E8C
Revocation Date: Dec 23 12:25:12 2016 GMT
Serial Number: 3BB94E8D
Revocation Date: Dec 23 12:26:15 2016 GMT
Serial Number: 3BB94E8E
</pre>
Kyseinen tiedosto on aika iso ja sisältää tällä hetkellä yli 282 000 riviä tekstiä, eli yli 122 000 varmennetta on laitettu sulkulistalle.
=== G2: VRK Gov. Root CA - G2 ===
Uudessa G2 varmenteissa tiedot ovat muuten samat, mutta urlit ovat hieman erilaisia:
<pre>
openssl x509 -in certs/vrkcqc3.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/arl/vrkroot2a.crl
...
</pre>
<pre>
wget -q -O- http://proxy.fineid.fi/arl/vrkroot2a.crl | openssl crl -inform der -text -noout
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha512WithRSAEncryption
Issuer: C = FI, O = Vaestorekisterikeskus CA, OU = Certification Authority Services, OU = Varmennepalvelut, CN = VRK Gov. Root CA - G2
Last Update: Jun 15 07:44:43 2020 GMT
Next Update: Jun 15 07:44:43 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:D1:A7:08:16:07:9E:E9:BD:4E:D3:D7:20:53:96:59:06:27:D7:88:4D
X509v3 Issuing Distribution Point:
Only CA Certificates
X509v3 CRL Number:
4
No Revoked Certificates.
Signature Algorithm: sha512WithRSAEncryption
65:a4:99:5a:6f:64:24:c9:19:92:e4:bc:42:ae:51:34:85:e2:
4c:0d:85:90:c6:3b:b8:46:dc:d2:09:ee:b9:2e:22:3b:bb:09:
33:bf:0e:58:93:12:ad:33:ce:88:ce:d0:1e:31:1d:dd:31:de:
c2:24:5b:30:61:e3:5e:05:a9:c5:c2:86:ea:f7:01:4a:17:ff:
46:23:af:06:48:93:6b:ac:09:7f:68:9a:5d:b0:fa:44:b4:02:
92:9b:86:c4:38:bd:58:f1:be:90:90:22:30:97:ac:09:fd:97:
c8:a7:ea:bf:bb:ad:61:e4:d3:da:6d:22:d5:b1:e8:ac:61:99:
8b:40:b7:56:f1:f1:ca:cb:48:41:fd:d1:ab:dd:55:2c:00:0a:
1a:58:22:d9:b0:10:c5:d5:c9:23:3c:24:e5:ba:fa:d9:50:98:
56:6a:17:8a:79:7a:28:47:94:3c:52:5d:99:5f:1c:5b:db:34:
a8:13:9d:62:f7:0f:99:37:a8:69:8c:ae:29:41:72:5d:29:90:
72:a1:5f:71:f4:9d:4d:26:37:cb:db:f6:ee:27:93:eb:a9:c2:
e5:3b:9e:7e:43:36:f5:34:05:77:3b:dc:65:01:af:48:86:78:
3e:82:69:df:ea:62:c0:1f:35:27:f8:26:52:0a:5b:3b:55:4d:
c8:30:cf:a7:25:4c:5e:24:05:30:73:d0:4d:b3:46:d6:98:3a:
0a:26:a8:ca:af:c4:61:98:45:0a:0d:f2:9a:19:61:43:5e:ab:
13:8b:ac:1f:d0:ca:5f:fb:6e:f2:5c:5b:f5:f2:20:50:2f:bb:
df:ee:82:94:d6:db:34:c6:d4:e8:fb:2a:d3:dc:66:a3:8d:c6:
ca:d8:96:1d:14:d0:96:e1:ef:4b:2a:45:13:31:75:51:15:fc:
73:4e:e4:7a:21:f1:3a:ba:b8:64:65:94:42:e7:8a:d5:89:9e:
9c:57:a0:b3:62:9c:3f:64:07:36:1a:0d:08:76:81:8d:0c:8d:
bd:a2:47:b9:32:41:ec:31:8c:ea:98:79:af:07:ea:86:05:b4:
e4:a3:bb:ae:2a:b5:59:bb:13:aa:7b:8e:10:c5:28:85:84:fe:
53:45:51:2a:b7:ac:94:da:9e:c8:b9:25:f9:40:62:93:4b:f7:
53:8a:9b:25:58:b1:89:18:d4:04:76:62:2d:60:85:ba:5a:33:
fa:be:3d:d6:61:05:30:aa:2a:c8:97:a6:5e:aa:16:90:22:7f:
93:8a:b4:7a:79:04:9e:e2:71:ff:6c:c8:b6:b6:aa:dd:39:e7:
e4:df:fd:41:5a:05:86:01:38:3a:91:5b:2d:2c:55:bc:47:d8:
5f:ce:65:d9:89:cc:2f:29
</pre>
Vastaavat tiedot henkilövarmenteesta:
<pre>
openssl x509 -in certs/cert3.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/crl/vrkcqc3c.crl
...
</pre>
Ja CRL:n voi hakea ja näyttää siitä alusta ensimmäiset 20 riviä:
<pre>
wget -q -O- http://proxy.fineid.fi/crl/vrkcqc3c.crl | openssl crl -inform der -text -noout | head -20
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha512WithRSAEncryption
Issuer: C = FI, O = Vaestorekisterikeskus CA, OU = Valtion kansalaisvarmenteet, CN = VRK Gov. CA for Citizen Certificates - G3
Last Update: Mar 17 19:01:41 2021 GMT
Next Update: Mar 18 03:01:41 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:83:29:6B:5F:FF:C3:EC:F4:3F:48:D5:9A:A5:9E:C9:C6:D8:34:D9:C2
X509v3 CRL Number:
24852
Revoked Certificates:
Serial Number: 3BE71541
Revocation Date: May 9 10:54:53 2018 GMT
Serial Number: 3BE722E1
Revocation Date: May 9 10:54:53 2018 GMT
Serial Number: 3BE72621
Revocation Date: May 16 11:30:00 2018 GMT
Serial Number: 3BE72F41
</pre>
Tämäkin tiedosto on jo aika iso ja sisältää tällä hetkellä yli 147 000 riviä tekstiä, eli yli 61 000 varmennetta on laitettu sulkulistalle.
== Digiviraston tarjoamat CRL palvelut ==
Kaikissa dvv:n varmenteissa on mukana tiedot mistä sulkulistat löytyvät. Itse sulkulistoja päivitetään samalla tavalla kuin [[Digivirasto/OCSP|OCSP]] tietojakin.
Eli alla olevissa esimerkeissä näkyy että G1 henkilökorttien '''This Update''' sulkulista on luotu vähän ennen tasatuntia ja G2 henkilökorttien lista vuorostaan pari minuuttia tasatunnin jälkeen.
=== G1: VRK Gov. Root CA ===
Intermediate CA:ssa on ARL (Authority Revocation List) tiedot:
<pre>
openssl x509 -in certs/vrkcqc2.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/arl/vrkroota.crl
...
</pre>
Itse ARL:n voi hakea seuraavasti ja näyttää sen ruudussa:
<pre>
wget -q -O- http://proxy.fineid.fi/arl/vrkroota.crl | openssl crl -inform der -text -noout
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = FI, ST = Finland, O = Vaestorekisterikeskus CA, OU = Certification Authority Services, OU = Varmennepalvelut, CN = VRK Gov. Root CA
Last Update: Dec 4 07:33:15 2020 GMT
Next Update: Dec 4 07:33:15 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:DB:E9:E1:9B:D2:D1:24:0B:FC:AB:E3:A0:67:EA:AE:9C:4B:77:F4:B0
X509v3 Issuing Distribution Point:
Only CA Certificates
X509v3 CRL Number:
36
Revoked Certificates:
Serial Number: 01A657
Revocation Date: May 6 08:23:06 2019 GMT
CRL entry extensions:
X509v3 CRL Reason Code:
Cessation Of Operation
Signature Algorithm: sha256WithRSAEncryption
99:84:81:14:51:0a:e1:fd:e7:68:09:a5:f8:cb:83:88:6a:66:
40:f6:19:b9:26:38:89:e5:63:f3:a5:27:ec:72:63:b0:a2:bb:
92:eb:d1:0b:59:b5:1d:72:1a:b4:57:42:cd:e7:e5:a7:a5:62:
ad:98:11:8e:c8:62:e8:fe:68:0b:76:9d:3e:34:4b:92:4c:c3:
5b:17:68:02:76:fb:80:11:22:fe:40:9d:5d:8f:9f:3a:f4:e0:
15:31:e0:31:51:70:a7:54:05:af:77:14:fe:a8:e4:b0:f7:ec:
56:21:f2:c0:86:37:7d:8e:1a:f1:91:57:53:5f:cb:9f:57:57:
8d:d2:6f:fe:6b:bf:64:4f:b8:64:c5:13:0f:f0:01:d1:33:b7:
ad:16:d7:62:ce:35:8f:1d:71:40:35:7d:36:94:11:08:dd:89:
74:74:63:77:41:cc:57:e3:c0:4d:89:8c:16:5f:0b:00:a5:1f:
c1:4e:f8:ca:c8:81:72:d8:48:74:b2:7a:68:ad:43:7e:c9:e9:
9d:ce:f6:e9:f3:90:d5:56:81:ee:9d:77:50:51:5f:f0:be:d3:
32:40:ca:38:ee:80:be:b0:f7:cf:4c:9a:de:28:b4:0f:38:f5:
23:3f:6f:60:fa:06:00:9c:f4:70:02:23:61:9a:e4:cb:c3:41:
cc:f8:54:a6
</pre>
Vastaavat tiedot henkilövarmenteesta:
<pre>
openssl x509 -in certs/cert1.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/crl/vrkcqc2c.crl
...
</pre>
Ja CRL:n voi hakea ja näyttää siitä alusta ensimmäiset 20 riviä:
<pre>
wget -q -O- http://proxy.fineid.fi/crl/vrkcqc2c.crl | openssl crl -inform der -text -noout | head -20
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = FI, O = Vaestorekisterikeskus CA, OU = Valtion kansalaisvarmenteet, CN = VRK Gov. CA for Citizen Qualified Certificates - G2
Last Update: Mar 17 18:59:13 2021 GMT
Next Update: Mar 18 02:59:13 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:C1:AF:1D:8A:5F:1D:9A:87:0D:82:10:FC:9D:DD:F5:B0:1E:70:D3:B5
X509v3 CRL Number:
64641
Revoked Certificates:
Serial Number: 3BB94E81
Revocation Date: Dec 23 12:25:27 2016 GMT
Serial Number: 3BB94E8C
Revocation Date: Dec 23 12:25:12 2016 GMT
Serial Number: 3BB94E8D
Revocation Date: Dec 23 12:26:15 2016 GMT
Serial Number: 3BB94E8E
</pre>
Kyseinen tiedosto on aika iso ja sisältää tällä hetkellä yli 282 000 riviä tekstiä, eli yli 122 000 varmennetta on laitettu sulkulistalle.
=== G2: VRK Gov. Root CA - G2 ===
Uudessa G2 varmenteissa tiedot ovat muuten samat, mutta urlit ovat hieman erilaisia:
<pre>
openssl x509 -in certs/vrkcqc3.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/arl/vrkroot2a.crl
...
</pre>
<pre>
wget -q -O- http://proxy.fineid.fi/arl/vrkroot2a.crl | openssl crl -inform der -text -noout
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha512WithRSAEncryption
Issuer: C = FI, O = Vaestorekisterikeskus CA, OU = Certification Authority Services, OU = Varmennepalvelut, CN = VRK Gov. Root CA - G2
Last Update: Jun 15 07:44:43 2020 GMT
Next Update: Jun 15 07:44:43 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:D1:A7:08:16:07:9E:E9:BD:4E:D3:D7:20:53:96:59:06:27:D7:88:4D
X509v3 Issuing Distribution Point:
Only CA Certificates
X509v3 CRL Number:
4
No Revoked Certificates.
Signature Algorithm: sha512WithRSAEncryption
65:a4:99:5a:6f:64:24:c9:19:92:e4:bc:42:ae:51:34:85:e2:
4c:0d:85:90:c6:3b:b8:46:dc:d2:09:ee:b9:2e:22:3b:bb:09:
33:bf:0e:58:93:12:ad:33:ce:88:ce:d0:1e:31:1d:dd:31:de:
c2:24:5b:30:61:e3:5e:05:a9:c5:c2:86:ea:f7:01:4a:17:ff:
46:23:af:06:48:93:6b:ac:09:7f:68:9a:5d:b0:fa:44:b4:02:
92:9b:86:c4:38:bd:58:f1:be:90:90:22:30:97:ac:09:fd:97:
c8:a7:ea:bf:bb:ad:61:e4:d3:da:6d:22:d5:b1:e8:ac:61:99:
8b:40:b7:56:f1:f1:ca:cb:48:41:fd:d1:ab:dd:55:2c:00:0a:
1a:58:22:d9:b0:10:c5:d5:c9:23:3c:24:e5:ba:fa:d9:50:98:
56:6a:17:8a:79:7a:28:47:94:3c:52:5d:99:5f:1c:5b:db:34:
a8:13:9d:62:f7:0f:99:37:a8:69:8c:ae:29:41:72:5d:29:90:
72:a1:5f:71:f4:9d:4d:26:37:cb:db:f6:ee:27:93:eb:a9:c2:
e5:3b:9e:7e:43:36:f5:34:05:77:3b:dc:65:01:af:48:86:78:
3e:82:69:df:ea:62:c0:1f:35:27:f8:26:52:0a:5b:3b:55:4d:
c8:30:cf:a7:25:4c:5e:24:05:30:73:d0:4d:b3:46:d6:98:3a:
0a:26:a8:ca:af:c4:61:98:45:0a:0d:f2:9a:19:61:43:5e:ab:
13:8b:ac:1f:d0:ca:5f:fb:6e:f2:5c:5b:f5:f2:20:50:2f:bb:
df:ee:82:94:d6:db:34:c6:d4:e8:fb:2a:d3:dc:66:a3:8d:c6:
ca:d8:96:1d:14:d0:96:e1:ef:4b:2a:45:13:31:75:51:15:fc:
73:4e:e4:7a:21:f1:3a:ba:b8:64:65:94:42:e7:8a:d5:89:9e:
9c:57:a0:b3:62:9c:3f:64:07:36:1a:0d:08:76:81:8d:0c:8d:
bd:a2:47:b9:32:41:ec:31:8c:ea:98:79:af:07:ea:86:05:b4:
e4:a3:bb:ae:2a:b5:59:bb:13:aa:7b:8e:10:c5:28:85:84:fe:
53:45:51:2a:b7:ac:94:da:9e:c8:b9:25:f9:40:62:93:4b:f7:
53:8a:9b:25:58:b1:89:18:d4:04:76:62:2d:60:85:ba:5a:33:
fa:be:3d:d6:61:05:30:aa:2a:c8:97:a6:5e:aa:16:90:22:7f:
93:8a:b4:7a:79:04:9e:e2:71:ff:6c:c8:b6:b6:aa:dd:39:e7:
e4:df:fd:41:5a:05:86:01:38:3a:91:5b:2d:2c:55:bc:47:d8:
5f:ce:65:d9:89:cc:2f:29
</pre>
Vastaavat tiedot henkilövarmenteesta:
<pre>
openssl x509 -in certs/cert3.pem -text -noout
Certificate:
...
X509v3 CRL Distribution Points:
Full Name:
URI:http://proxy.fineid.fi/crl/vrkcqc3c.crl
...
</pre>
Ja CRL:n voi hakea ja näyttää siitä alusta ensimmäiset 20 riviä:
<pre>
wget -q -O- http://proxy.fineid.fi/crl/vrkcqc3c.crl | openssl crl -inform der -text -noout | head -20
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorithm: sha512WithRSAEncryption
Issuer: C = FI, O = Vaestorekisterikeskus CA, OU = Valtion kansalaisvarmenteet, CN = VRK Gov. CA for Citizen Certificates - G3
Last Update: Mar 17 19:01:41 2021 GMT
Next Update: Mar 18 03:01:41 2021 GMT
CRL extensions:
X509v3 Authority Key Identifier:
keyid:83:29:6B:5F:FF:C3:EC:F4:3F:48:D5:9A:A5:9E:C9:C6:D8:34:D9:C2
X509v3 CRL Number:
24852
Revoked Certificates:
Serial Number: 3BE71541
Revocation Date: May 9 10:54:53 2018 GMT
Serial Number: 3BE722E1
Revocation Date: May 9 10:54:53 2018 GMT
Serial Number: 3BE72621
Revocation Date: May 16 11:30:00 2018 GMT
Serial Number: 3BE72F41
</pre>
Tämäkin tiedosto on jo aika iso ja sisältää tällä hetkellä yli 147 000 riviä tekstiä, eli yli 61 000 varmennetta on laitettu sulkulistalle.
