Obtain CRL from download server

[rullzer]

It would make sense if the CRL was also publsihed on our download server. That way with a cron job we could fetch it daily. (proper etag etc). That way we do not have to wait for a new server release to get an updated CRL when a certificate had to be revoked.

[MorrisJobke]

It would make sense if the CRL was also publsihed on our download server. That way with a cron job we could fetch it daily. (proper etag etc). That way we do not have to wait for a new server release to get an updated CRL when a certificate had to be revoked.

Keep in mind to check the signature of the CRL so cannot MITMed ;)

[rullzer]

Of course :)

[j-ed]

@rullzer Instead of downloading a file on a regular base and generating traffic etc., it would be worse to use the update information from the CRL file itself to trigger an update. I've setup a similar mechanism on my server to keep all crl files up-to-date:

# openssl crl -in <crl-file-in-pem-format> -noout -lastupdate -nextupdate
lastUpdate=Jan  6 23:21:10 2019 GMT
nextUpdate=Jan 13 23:21:10 2019 GMT

[rullzer]

@j-ed well I do not expect this to happen often. And there will be a proper etag. But I could also login to that as well

[MorrisJobke]

@rullzer moved to 17.