On Fri, 2009-03-13 at 02:55 +0100, Raphael PRECIGOUT wrote:

Hello,

As far as I can read in the Dovecot SSL configuration wiki page, each CA cert must be followed by the related CA CRL in the client certificate verification context ("ssl_ca_file" setting). In my company we do have our own PKI and as soon as Client certificate is compromised we do revoke it and update the related CA's CRL. Does that mean that I have to issue a new "ssl_ca_file" file as soon as our issuing CA CRL is updated ? If yes, does someone has an idea on how to do so ?

I haven't bothered to read how CRLs work exactly, but I'd guess "yes". This is all handled by OpenSSL library internally, so whatever documentation you can find about other servers using OpenSSL probably applies to Dovecot too.

Is it then necessary to restart dovecot process (to take the "ssl_ca_file" file changes into account) ?

kill -HUP is enough.

Does Dovecot have a way to check the issuing CA CRL automatically ? (the CRL is published in DER format and is accessible though http, the URI is mentionned in the CRL Distribution points of the CA certificate)

If OpenSSL doesn't do that automatically (probably not), then not currently. I guess that might be a nice feature in future, but it's a very low priority to me.