# Crl-file causes client authentication failure

**URL:** <https://discourse.haproxy.org/t/crl-file-causes-client-authentication-failure/4253>\
**Category:** Help!\
**Created:** [August 29, 2019, 2:12pm UTC](https://discourse.haproxy.org/t/crl-file-causes-client-authentication-failure/4253 "2019-08-29T14:12:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidmosler](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@davidmosler](https://discourse.haproxy.org/u/davidmosler)\
**Post date:** [August 29, 2019, 2:12pm UTC](https://discourse.haproxy.org/t/crl-file-causes-client-authentication-failure/4253/1 "2019-08-29T14:12:24Z")

</div>

Hello,  
I have a strange issue with crl-file.

Quick intro:  
HAProxy 1.5.18-8.el7  
CentOS Linux release 7.6.1810 (Core)

We use our internal CA runs on a Windows server. When i want to use it’s crl i have to do these steps.

- download root CA, intermediate CAs
- covert them to x509
- merge into one file (CRL.pem)

I always do these steps using a script. The script contains a part for controlling if there are a new revocation record in final crl - if yes, HAProxy is restarted due to upload fresh information from crl. The script is launched regulary once a day.

I use the result, CRL.pem, as part of this client certificate authentication.  
_bind abns@go\_to\_fe\_application accept-proxy ssl crt /etc/haproxy/certs/ ca-file /etc/pki/ca-trust/source/anchors/CA.pem crl-file /etc/pki/tls/misc/CRL.pem verify required_

And it works. But just about two days - i didn’t measure it exactly. And after that it sudenly stop without a clear reason. See the output from curl below:

> curl --insecure --cert-type pem --cert davidmosler.pem -vvv [https://mydomain.global](https://mydomain.global)  
> Rebuilt URL to: [https://mydomain.global/](https://mydomain.global/)  
> Trying 192.168.16.16…  
> TCP\_NODELAY set  
> Connected to mydomain.global (192.168.16.16) port 443 (#0)  
> Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH  
> error setting certificate verify locations, continuing anyway:  
> CAfile: /etc/pki/tls/certs/ca-bundle.crt  
> CApath: none  
> TLSv1.2 (OUT), TLS handshake, Client hello (1):  
> TLSv1.2 (IN), TLS handshake, Server hello (2):  
> TLSv1.2 (IN), TLS handshake, Certificate (11):  
> TLSv1.2 (IN), TLS handshake, Server key exchange (12):  
> TLSv1.2 (IN), TLS handshake, Request CERT (13):  
> TLSv1.2 (IN), TLS handshake, Server finished (14):  
> TLSv1.2 (OUT), TLS handshake, Certificate (11):  
> TLSv1.2 (OUT), TLS handshake, Client key exchange (16):  
> TLSv1.2 (OUT), TLS handshake, CERT verify (15):  
> TLSv1.2 (OUT), TLS change cipher, Client hello (1):  
> TLSv1.2 (OUT), TLS handshake, Finished (20):  
> TLSv1.2 (IN), TLS alert, Server hello (2):  
> error:14094415:SSL routines:SSL3\_READ\_BYTES:sslv3 alert certificate expired  
> Curl\_http\_done: called premature == 1  
> Closing connection 0  
> curl: (35) error:14094415:SSL routines:SSL3\_READ\_BYTES:sslv3 alert certificate expired

Well… _alert certificate expired._ But i would say that isn’t true:

My client certificate is valid.

> openssl x509 -in davidmosler.pem -text | grep Validity -A 2  
> Validity  
> Not Before: May 16 09:24:35 2019 GMT  
> Not After : May 15 09:24:35 2020 GMT

And according this output I would guess that my crl is valid as well:

> openssl crl -in CRL.pem -text | grep Issuer -A 2  
> Issuer: /CN=RootCA  
> Last Update: Jun 7 07:16:52 2019 GMT  
> Next Update: Jun 6 19:36:52 2020 GMT

But it doesn’t work. Unless I just move CRL.pem away (for later detailed inspection). Run the script mentioned before and restart HAProxy. Then I get:

> HTTP/1.1 200 OK

I compared content of both CRL.pem files (old and new).

> crl -in CRL.pem -noout -text \> oldCRL.pem  
> crl -in CRL.pem -noout -text \> newCRL.pem  
> diff oldCRL.pem newCRL.pem

And the result is nothing. Both contents are identical.

Has anybody any idea where could be a problem?  
Thanks a lot in advance for your usefull hints.  
David

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [August 30, 2019, 2:40pm UTC](https://discourse.haproxy.org/t/crl-file-causes-client-authentication-failure/4253/2 "2019-08-30T14:40:03Z")

</div>

I suggest you take haproxy out of the picture and just use a OpenSSL test server with those parameters, to check where the issue is.

I guess it would look something link this (using SSL port 10443):

```
openssl s_server -port 10443 -cert /etc/haproxy/certs/mydomain.global.pem \
-CAfile /etc/pki/ca-trust/source/anchors/CA.pem \
-CRLform /etc/pki/tls/misc/CRL.pem \
-Verify -crl_check_all
```

---

<div class="post-metadata">

**Author:** ![davidmosler](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@davidmosler](https://discourse.haproxy.org/u/davidmosler)\
**Post date:** [August 30, 2019, 9:43pm UTC](https://discourse.haproxy.org/t/crl-file-causes-client-authentication-failure/4253/3 "2019-08-30T21:43:49Z")

</div>

Hello Lukas, thanks a lot for your reply. Good idea, I will do that.