How do CRLs work exactly?

RouterOS General
1

I use DoH to NextDNS and have enabled the built in certificate authorities. DoH works fine. But if I enable using CRLs (/certificate/settings/set crl-use=yes) then I suddenly get a zillion log errors

DoH server connection error: SSL: ssl: crl not found for: "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA" (6)

This is the NextDNS root CA, and I can see that it doesn’t have a CRL field specified in the certificate. Is it just Mikrotik’s implementation of the CRL functionality that errors out if a certificate doesn’t specify a CRL?

2

If there’s no CRL URL embedded in the CA certificate, there should be no attempt to retrieve one. In my thinking, that message should only occur if use-crl=yes is on, a CRL URL is embedded in the CA certificate and there is no CRL file at the given URL. If there’s no embedded CRL URL, the device should just move on. I would report that as a bug and get MikroTik support’s take on it.

The process is normally like this: The CA has a URL embedded that tells peers where to retrieve a signed CRL. The signed CRL is then retrieved, verified, and checked to ensure that the certificates involved in our connection haven't been revoked. If they have been, the certificate validation fails.

3

Thanks, this is how I assumed it would work. I will file a support ticket.

4

I don’t use th built in CA. Do you have any crl list in the certificate store?

It does have a crl it’s cross-signed:

ZeroSSL ECC Domain Secure Site CA

http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl

If you want a current work around. You will need to import the certifcate to the certificate store.

Side note: I have 233 certificates install in my certificate store.

I also had to install two certifcates for Docker.io

Playing “Wack-a-mole” with docker and certficates.

production.cloudflare.docker.com