Configuring Certificate Revocation

Certificate Revocation in JSSE can be done through two means: certificate revocation lists (CRLs) and OCSP.

Certificate Revocation can be very useful in situations where a server’s private keys are compromised, as in the case of Heartbleed.

Certificate Revocation is disabled by default in JSSE. It is defined in two places:

• PKI Programmer’s Guide, Appendix C
• Enable OCSP Checking

To enable OCSP, you must set the following system properties on the command line:

java -Dcom.sun.security.enableCRLDP=true -Dcom.sun.net.ssl.checkRevocation=true

After doing the above, you can enable certificate revocation in the client:

ssl-config.checkRevocation = true

Setting checkRevocation will set the internal ocsp.enable security property automatically:

java.security.Security.setProperty("ocsp.enable", "true")

And this will set OCSP checking when making HTTPS requests.

Or, if you wish to use a static CRL list, you can define a list of URLs:

ssl-config.revocationLists = [ "http://example.com/crl" ]

Further Reading

• Fixing Certificate Revocation