# Certificate not trusted/unknown once CRL is configured

**URL:** <https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940>\
**Category:** Help!\
**Created:** [November 19, 2020, 10:38am UTC](https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940 "2020-11-19T10:38:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tanja](https://avatars.discourse-cdn.com/v4/letter/t/838e76/32.png) [@tanja](https://discourse.haproxy.org/u/tanja)\
**Post date:** [November 19, 2020, 10:38am UTC](https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940/1 "2020-11-19T10:38:43Z")

</div>

I am using HAProxy version 1.8.10 currently and a self-signed CA. My CA cert file consists of the intermediate and root certificate. Now I want to use a CRL so HAProxy blocks access for revoked client certificates. I generated the CRL file by downloading the CRL’s for the intermediate and root certificate (client CA), converted them from der to pem file and added them together in one file.  
Whenever this CRL is configured in my haproxy config, I receive the error “sslv3 alert certificate unknown” on client side and in the haproxy logs I can see “SSL client certificate not trusted” with any certificate I use (revoked or not revoked). Once I remove the CRL I can connect without any problem.

I tried many things to debug this but I can’t find the issue. Can anybody help me please?

---

<div class="post-metadata">

**Author:** ![carlos](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carlos](https://discourse.haproxy.org/u/carlos)\
**Post date:** [November 15, 2021, 6:40pm UTC](https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940/2 "2021-11-15T18:40:15Z")

</div>

I have the same pb

---

<div class="post-metadata">

**Author:** ![AaronWest](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aaronwest/32/164_2.png) [@AaronWest](https://discourse.haproxy.org/u/AaronWest)\
**Post date:** [November 15, 2021, 7:25pm UTC](https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940/3 "2021-11-15T19:25:00Z")

</div>

It’s an old example now but was actually done using 1.8.

But have you tried following my Blog, just to see if that works for you as it’s all local self signed certs…

> **[Client Certificate Authentication with HAProxy](https://www.loadbalancer.org/blog/client-certificate-authentication-with-haproxy/)**
>
> Using client certificates for security is a pretty cool idea! You can protect an entire application or even just a specific Uniform Resource Identifier (URI) to only those that provide a valid client certificate.

If so it might prove something else is wrong in your process. I’ll help if I can.

---

<div class="post-metadata">

**Author:** ![carlos](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carlos](https://discourse.haproxy.org/u/carlos)\
**Post date:** [November 15, 2021, 8:32pm UTC](https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940/4 "2021-11-15T20:32:14Z")

</div>

@AaronWest. your blog is very good but we need to know how to analyse haproxy ssl log to find a solution.  
For example in my case with crl,  
in client side, slv3 alert certificate unknown  
in the server side, ssl client CA chain canot be verified

Without crl in haproxy config, everying is working very good  
I have only ca et client crt and crl.

---

<div class="post-metadata">

**Author:** ![AaronWest](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/aaronwest/32/164_2.png) [@AaronWest](https://discourse.haproxy.org/u/AaronWest)\
**Post date:** [November 15, 2021, 9:14pm UTC](https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940/5 "2021-11-15T21:14:56Z")

</div>

@carlos  
So “slv3 alert certificate unknown” means that the client certificate cannot be verified.

While “ssl client CA chain canot be verified” means pretty much the same, so it cannot verify the client against the CA.

As you say it works before you add the CRL this makes me think either it’s malformed, missing info or otherwise incorrect in some other way.

That’s why I’m suggesting you make your own as a test, prove to yourself it should work, then compare that to your setup and hopefully you’ll see what’s missing.

---

<div class="post-metadata">

**Author:** ![carlos](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@carlos](https://discourse.haproxy.org/u/carlos)\
**Post date:** [November 15, 2021, 9:25pm UTC](https://discourse.haproxy.org/t/certificate-not-trusted-unknown-once-crl-is-configured/5940/6 "2021-11-15T21:25:15Z")

</div>

@AaronWest thanks.  
Your anwser is so valuable to us.

I confirme that when I remove crl from haproxy config ==\> it is working  
I am able to parse crl using this commande

openssl crl -inform DER -text -noout -in mycrl.crl

So malformed is not the case.

I see (x509v3 Freshest CRl and issuing distribution point) inside my crl file.

maybe this is the pb ? I used chrome and i can get the crl in der format without pb using the http distribution point .

**Also, in your blog, [Client Certificate Authentication with HAProxy](https://www.loadbalancer.org/blog/client-certificate-authentication-with-haproxy/)**  
**the crl generated is without a distribution point http (without x509v3 Freshest CRl and issuing distribution point) and crl in your blog is working with me.**

So i think the pb is in haproxy where it is not able to working with x509v3 Freshest CRl and issuing distribution point in crl

what do you think ?