Consul doesn't verify TLS certificates against revocation list
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
### `consul version` for both Client and Server
Client: `0.7.1`
Server: `0.7.1`
### `consul info` for both Client and Server
### Reproduction steps
-Configure Consul with TLS with all verification options on, using a certificate which contains a reference to a valid CRL.
-Start Consul and verify that everything works
-Revoke one of the certs and update CRL
-Start consul again
### Expected behavior:
Consul should verify certs against the CRL in intervals (since servers may be running for years) and deny traffic to/from agents using revoked certs
### Observed behavior:
Consul happily accepts traffic from a revoked certificate, and allows usage of expired certificates locally.
Contributor guide
Research direction
The issue names no source file, test, or entry point. Start by reproducing the TLS setup with a certificate referencing a CRL, revoke a certificate, update the CRL, and restart Consul. Done means revoked certificates are rejected and certificate revocation is rechecked while long-running agents operate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100