{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node-v0.x-archive/issues/25668","labels_url":"https://api.github.com/repos/nodejs/node-v0.x-archive/issues/25668/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node-v0.x-archive/issues/25668/comments","events_url":"https://api.github.com/repos/nodejs/node-v0.x-archive/issues/25668/events","html_url":"https://github.com/nodejs/node-v0.x-archive/issues/25668","id":94592577,"number":25668,"title":"TLS server missing CRL for an array of CAs prevents authentication","user":{"login":"AlanUnderwood","id":1203844,"avatar_url":"https://avatars.githubusercontent.com/u/1203844?v=3","gravatar_id":"","url":"https://api.github.com/users/AlanUnderwood","html_url":"https://github.com/AlanUnderwood","followers_url":"https://api.github.com/users/AlanUnderwood/followers","following_url":"https://api.github.com/users/AlanUnderwood/following{/other_user}","gists_url":"https://api.github.com/users/AlanUnderwood/gists{/gist_id}","starred_url":"https://api.github.com/users/AlanUnderwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AlanUnderwood/subscriptions","organizations_url":"https://api.github.com/users/AlanUnderwood/orgs","repos_url":"https://api.github.com/users/AlanUnderwood/repos","events_url":"https://api.github.com/users/AlanUnderwood/events{/privacy}","received_events_url":"https://api.github.com/users/AlanUnderwood/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-12T19:24:33Z","updated_at":"2015-12-23T03:18:57Z","closed_at":null,"body":"Using Node.js 0.12.7 on Linux (Ubuntu 15.04 & Centos 6)\r\n\r\nIf you create an https/tls server with an array of CAs and an array of CRLs, but one of the CAs does not have a matching CRL, then an authenticating client signed by that CA cannot connect. If there are no CRLs at all, then an authenticating client signed by that CA can connect i.e. you should be allowed to connect even if there is no CRL.\r\n\r\n## Steps to reproduce\r\n1. Create two Certificate Authorities, `CA1` & `CA2`.\r\n2. Create two user certificate, `userA` & `userB` signed by `CA1` and `CA2` respectively.\r\n3. Create a server certificate for the Node.js server signed by `CA1`.\r\n4. Create two Certificate Revocation Lists, one each for `CA1` and `CA2`.\r\n5. Add both CAs and user certificates to you browser as trusted authorities and user certificates respectively.\r\n6. Create a simple https Node.js app that uses both CAs, and CRLs in its options and start it.\r\n7. Start your browser and connect to the server, selecting `userA` certificate...success!\r\n8. Restart your browser and connect to the server, selecting `userB` certificate...success!\r\n9. Edit the Node.js app to remove the CRL for `CA2` and restart server.\r\n10. Restart your browser and connect to the server, selecting `userA` certificate...success!\r\n11. Restart your browser and connect to the server, selecting `userB` certificate...**Failure!**\r\n12. *Optional*, edit the Node.js app to remove crl and restart server. You can now connect as both `userA` and `userB`.\r\n\r\nThis is a problem for me where in my workplace I have a few self-signed CAs but not all of them have CRLs. I need to use CRLs for security, but because one of the CAs doesn't have a CRL, I'm a bit stuck!\r\n\r\n## Sample app.js\r\n```javascript\r\nvar fs = require('fs');\r\nvar https = require('https');\r\nvar privateKey = fs.readFileSync('/home/alan/ca1/private/localhost.key.pem', 'utf8');\r\nvar certificate = fs.readFileSync('/home/alan/ca1/certs/localhost.cert.pem', 'utf8');\r\nvar cas = [\r\n    fs.readFileSync('/home/alan/ca1/certs/ca1.cert.pem', 'utf8'),\r\n    fs.readFileSync('/home/alan/ca2/certs/ca2.cert.pem', 'utf8')\r\n];\r\nvar crls = [\r\n    fs.readFileSync('/home/alan/ca1/crl/ca1.crl.pem', 'utf8')\r\n    ,fs.readFileSync('/home/alan/ca2/crl/ca2.crl.pem', 'utf8')\r\n];\r\n\r\nvar credentials = {\r\n    key: privateKey,\r\n    cert: certificate,\r\n    ca: cas,\r\n    crl: crls,\r\n    requestCert: true,\r\n    rejectUnauthorized: true\r\n};\r\nhttps.createServer(credentials, function (req, res) {\r\n    var clientCert = req.client.getPeerCertificate();\r\n    res.writeHead(200);\r\n    res.end('Certificate info!' + JSON.stringify(clientCert.subject, true, 2));\r\n}).listen(8443);\r\n```"},"comment":{"url":"https://api.github.com/repos/nodejs/node-v0.x-archive/issues/comments/166795018","html_url":"https://github.com/nodejs/node-v0.x-archive/issues/25668#issuecomment-166795018","issue_url":"https://api.github.com/repos/nodejs/node-v0.x-archive/issues/25668","id":166795018,"user":{"login":"chiradip","id":944942,"avatar_url":"https://avatars.githubusercontent.com/u/944942?v=3","gravatar_id":"","url":"https://api.github.com/users/chiradip","html_url":"https://github.com/chiradip","followers_url":"https://api.github.com/users/chiradip/followers","following_url":"https://api.github.com/users/chiradip/following{/other_user}","gists_url":"https://api.github.com/users/chiradip/gists{/gist_id}","starred_url":"https://api.github.com/users/chiradip/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chiradip/subscriptions","organizations_url":"https://api.github.com/users/chiradip/orgs","repos_url":"https://api.github.com/users/chiradip/repos","events_url":"https://api.github.com/users/chiradip/events{/privacy}","received_events_url":"https://api.github.com/users/chiradip/received_events","type":"User","site_admin":false},"created_at":"2015-12-23T03:18:57Z","updated_at":"2015-12-23T03:18:57Z","body":"In that case ask their CRL link. and download the file yourself. If you must use CRL, you have owner all the CAs CRLs - as revocation may happen at any level. Now there is a rub with CRLs, it hard to keep updated and when updated, server that is using those CRLs needs to either restart or have a mechanism to reload the CRLs. OCSP and OCSP stapling solve this issue beside many other issues of CRL."}}