Linux Certif

Toute la documentation sur la certification Linux LPI

fetch-crl

NAME

fetch-crl - retrieve certificate revocation lists

SYNOPSIS

fetch-crl [-l locationDirectory] [-o outputDirectory] [-a agingTolerance] [-q]

DESCRIPTION

fetch-crl retrieves certificate revocation lists (CRLs). CRLs can be retrieved from web sites using the HTTP or HTTPS protocols and can be in either PEM or DER encoded form. The URLs for the CRL download are to be found in files named hash.r0 and should accompany a CA root certificate with the same hash. Retrieving a CRL without an accompanying CA root certificate will result in a verification failure.

OPTIONS

-h --help

Show help text.

-l --loc locationDirectory

The script will search this directory for files with the suffix '.crl_url'. It is supposed that each one of these files contains the URL of a Certificate Revocation List (CRL) for a Certification Authority. This URL is of the form http://www.myhost.com/myCRL. Note: the CRL files to download must be in either PEM or DER format.

For validity checking of the CA certificates, this script assumes that the certificates of the CAs are found also in this directory.

Default: output directory (see below)

-o --out outputDirectory

Directory where to put the downloaded and processed CRLs. The directory to be used as argument for this option is typically /etc/grid-security/certificates

Default: current working directory

-a --agingtolerance hours

The maximum age of the locally downloaded CRL before download failures trigger actual error messages. This error message suppression mechanism only works if the crl_url files are named after the hash of the CRL issuer name, a stat(1) command is installed, and a CRL has already been downloaded at least once.

Default: no aging tolerance

-q --quiet

Quiet mode (do not print information messages)

-n, --no-check-certificate

Do not check the server certificate when retrieving URLs. (see also: SERVERCERTCHECK=no in /etc/fetch-crl.conf.

NOTES

Defaults can be set in the fetch-crl system configuration file /etc/fetch-crl.conf, using the CRLDIR and QUIET directives. If you want a specific version of OpenSSL to be used by fetch-crl for converting and validating CRLs, set the FETCH_CRL_OPENSSL environment variable (via /etc/fetch-crl.conf). For historical reasons, if /etc/fetch-crl.conf does not exist, but /etc/sysconfig/fetch-crl does, the latter file is read instead.

The script will try to use the latest version of OpenSSL to be found anywhere in your path or in /usr/bin , /usr/local/bin (or in the $GLOBUS_LOCATION/bin directory when available). Use of the latest version of OpenSSL is strongly encouraged.

The fetch-crl script should preferably be run from cron(8) at least once every day. See /usr/share/doc/fetch-crl-version for en example cron job to install.

Other configuration variables recognised in /etc/fetch-crl.conf:

WGET_RETRIES n

Number of attempts of wget to obtain the CRL from the specified location.

WGET_TIMEOUT seconds

Number of seconds to wait for each stage of the http GET request (i.e. seconds sec for DNS resolving, and the same amount for downloading, etc.)

SERVERCERTCHECK {yes,no}

When set to "no", the check of the server certificate validity is suppressed (applies to wget version 1.10 and higher only).

WGET_OPTS options

Additional command-line arguments to be passed to the invocations of wget.

LOGFILE filename

In addition to all other message output mechanisms, also append generated messages to the file filename

CRL_AGING_THRESHOLD hours

Only complain about failed CRL download if the download failed persistently for more than hours consecutive hours, or if the current time is past the advertised nextUpdate time for this CRL.

SEE ALSO

openssl(1)

DIAGNOSTICS

Exit status is normally 0; if an error occurs, exit status is 1 and diagnostics will be written to standard error.

BUGS

The fetch-crl program cannot handle CRLs for multiple certificates with the same hash value.