hashicorp / hashicorp/consul

Consul doesn't verify TLS certificates against revocation list

Open
#2,681 1 comment 11 reactions 0 assignees View on GitHub
theme/operator-usability type/enhancement
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

### `consul version` for both Client and Server
Client: `0.7.1`
Server: `0.7.1`

### `consul info` for both Client and Server
### Reproduction steps
-Configure Consul with TLS with all verification options on, using a certificate which contains a reference to a valid CRL.
-Start Consul and verify that everything works
-Revoke one of the certs and update CRL
-Start consul again

### Expected behavior:
Consul should verify certs against the CRL in intervals (since servers may be running for years) and deny traffic to/from agents using revoked certs

### Observed behavior:
Consul happily accepts traffic from a revoked certificate, and allows usage of expired certificates locally.

Contributor guide

Open the contributing guide

Research direction

The issue names no source file, test, or entry point. Start by reproducing the TLS setup with a certificate referencing a CRL, revoke a certificate, update the CRL, and restart Consul. Done means revoked certificates are rejected and certificate revocation is rechecked while long-running agents operate.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.