TCP Socket - Java SSL Certificate Revocation Checking
<p>I'm currently writing a network TCP server using SSL. In production, we'll finally require clients to authenticate with a certificate.</p>
<p>In order to revoke certificates in case of a emergency, we would also like to establish a CRL.</p>
<p>My question is: Does Java check CRLs (if provided with the certificate) out of the box or do I need to manually implement such checks?</p>
<p>For testing, I prepared a certificate with a CRL set but Java does not seem to try to validate it (I dropped it into a local web server and there's no access).</p>
<p>I only found the <em>com.sun.net.ssl.checkRevocation=true</em> VM option, but apparently it doesn't query the CRL. VM debugging set to <em>java.security.debug=certpath</em> does not generate any output, either...</p>
<p>Java seems to have related classes in its subsystems (e.g. <em>java.security.cert.X509CRLSelector</em>), but it does not come into play, obviously.</p>
<p><em>edit</em>: Removed outdated Dropbox link</p>