CODEWITHSUNDEEP
javaspringsslspring-securityx509
Alan L
Alan L

Reputation: 133

Check X509 certificate revocation status in Spring-Security before authenticating

Is it possible to check the revocation status of a x509 client certificate through the CRL in spring-security before authenticating it? I've checked documentations (http://static.springsource.org/spring-security/site/docs/3.0.x/reference/x509.html) but it doesn't mention anything about CRL.

Implementing UserService only gives you the username and not the X509Certificate. Any help would be appreciated!

Thanks!

Upvotes: 4

Views: 9813

Answers (2)

Shaun the Sheep
Shaun the Sheep

Reputation: 22752

The SSL handshake is performed by the servlet container, rather than Spring Security, so any CRL checking should probably occur at that point. Spring Security treats it as a "pre-authentication" scenario.

Spring Security just reads the (already SSL-authenticated) certificate and allows you to link it to a local user account.

Upvotes: 5

Bruno
Bruno

Reputation: 122719

I'm not sure about the specifics of Spring-Security, but if it's based on the trustmanagers of the JRE (if if it's the Oracle/Sun JRE), you can activate CRL checks by setting these system properties to true: com.sun.net.ssl.checkRevocation and com.sun.security.enableCRLDP, and setting Security.setProperty("ocsp.enable", "true") (thanks to @WillSargent for pointing out it's a Security property, not a system one).

More details here:

Upvotes: 7

Related Questions