2 ms·
It's the client that is supposed to fetch the CRL. The server doesn't care unless it does client certificate authentication (which is incredibly rare due to po
by eqvinox 2y ago
It's the client that is supposed to fetch the CRL. The server doesn't care unless it does client certificate authentication (which is incredibly rare due to poor UX.)
- hunter2_ 2y agoA server (nginx / httpd) might very well make outbound HTTPS calls and want to verify the origin's certificate to the fullest extent possible. This is known as a reverse proxy. However, many -- certainly not all -- reverse proxy configurations use origin servers that reside on the same exact network, and therefore don't need TLS connections (or use them with `SSLProxyVerify none` for e.g. self-signed certs to simplify things [0]), but I digress. [0] https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslproxyverify https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslpr...