The GoAhead bug this week is a good reminder: a revocation list that “loads fine” isn’t the same as one that’s enforced. If you put client certificates in front of an admin panel or API with nginx, here’s how I’d check it actually works.
1. Point nginx at your CA and CRL
ssl_client_certificate /etc/nginx/mtls/ca.crt;
ssl_verify_client on;
ssl_crl /etc/nginx/mtls/ca.crl;Then nginx -t and reload.
2. Revoke a test cert and regenerate the CRL
With an OpenSSL ca setup: openssl ca -config ca.cnf -revoke test-client.crt, then openssl ca -config ca.cnf -gencrl -out ca.crl. Copy the new CRL into place and reload nginx.
3. Test both ways
curl -sk --cert good.crt --key good.key https://your-server/ -o /dev/null -w '%{http_code}\n'
curl -sk --cert test-client.crt --key test-client.key https://your-server/ -o /dev/null -w '%{http_code}\n'The good cert should get your page; the revoked one should get a 400 (“The SSL certificate error”). If both get in, revocation isn’t working.
4. Watch the CRL’s expiry
CRLs have a “next update” date. Check it with openssl crl -in ca.crl -noout -nextupdate. An expired CRL can lock out everyone, so set a reminder or a cron job to regenerate it well before then.
Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.
God Bless, and May the Source Be with You!
