# CRL list problem

**URL:** <https://discourse.haproxy.org/t/crl-list-problem/2471>\
**Category:** Help!\
**Created:** [May 8, 2018, 7:49am UTC](https://discourse.haproxy.org/t/crl-list-problem/2471 "2018-05-08T07:49:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![h947613](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@h947613](https://discourse.haproxy.org/u/h947613)\
**Post date:** [May 8, 2018, 7:49am UTC](https://discourse.haproxy.org/t/crl-list-problem/2471/1 "2018-05-08T07:49:18Z")

</div>

Hi, I have installed haproxy 1.8.7 and get problem with CRL list - even when I revoke a user’s certificate, the page appears to him.

test1 is my test user

1. CERT REVOKE:  
openssl ca -config /root/ca/intermediate/openssl.cnf -revoke /root/ca/users\_certs/test1/test1.crt

2. REGENERATE CRL  
openssl ca -config /root/ca/intermediate/openssl.cnf -gencrl -out /root/ca/intermediate/crl/intermediate.crl

3. ORDER CERT CHAIN IN HAPROXY CONFIG FILE (ca\_chain.crt)  
— INTERMEDIATE CERT —  
— CA CERT —

4. ORDER CRL CHAIN IN HAPORXY CONFIG FILE (crl.pem)  
— INTERMEDIATE CRL —  
— CA CRL —

5. ORDER FILES IN my.page.pem FILE  
— PRIVATE KEY WITHOUT PASSWORD —  
— my.page CERT SIGNED BY INTERMEDIATE CERT —

6. Full /etc/haproxy/haproxy.cfg  
global  
log /dev/log local0  
log /dev/log local1 notice  
chroot /var/lib/haproxy  
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners  
stats timeout 30s  
user haproxy  
group haproxy  
daemon

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 8, 2018, 8:04am UTC](https://discourse.haproxy.org/t/crl-list-problem/2471/2 "2018-05-08T08:04:07Z")

</div>

Are you sure you are reloading haproxy after updating the CRL? Also I suggest you remove the option `crt-ignore-err all` entirely.

---

<div class="post-metadata">

**Author:** ![h947613](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@h947613](https://discourse.haproxy.org/u/h947613)\
**Post date:** [May 8, 2018, 8:17am UTC](https://discourse.haproxy.org/t/crl-list-problem/2471/3 "2018-05-08T08:17:19Z")

</div>

@lukastribus thanks for your reply. When I removed **crt-ignore-err all** and restart haproxy all works well.  
THANK YOU!