Certificate Revocation List

Question

Certificate Revocation List

S Abijith 471

Hi All,

We have a WPF application built on .Net Framework v4.8. This application acts as an HTTPs client.

We are currently performing the certificate check using 'RemoteCertificateValidationCallback' method (except CRL).

We now need to perform CRL (Certificate Revocation List) check as part of certificate validation in this application.

Can anyone please let us know the best way to implement CRL check for the application?

Any help is appreciated.

Thank you in advance!!

Hui Liu-MSFT 48,681 Microsoft External Staff

Hi,@S Abijith. Welcome to Microsoft Q&A.

To implement Certificate Revocation List (CRL) checking in your WPF application, you could try to use the X509Chain class provided by the System.Security.Cryptography.X509Certificates namespace.

This callback method is called during the SSL/TLS handshake to validate the server's certificate.

private bool ValidateCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    if (sslPolicyErrors != SslPolicyErrors.None)
    {
        return false; 
    }
    X509Chain certChain = new X509Chain();
    certChain.ChainPolicy.RevocationMode = X509RevocationMode.Online; // Enable CRL check
    bool chainIsValid = certChain.Build((X509Certificate2)certificate);
    if (!chainIsValid)
    {
  
        return false;
    }
    return true;
}

Register the RemoteCertificateValidationCallback method with ServicePointManager.

ServicePointManager.ServerCertificateValidationCallback += ValidateCertificate;

S Abijith 471 Reputation points

2024-05-15T12:27:30.35+00:00

Hi @Hui Liu-MSFT,

Thank you for your response.

In the comment, it is visible that the 'RevocationMode' is set to 'Online'.

Can you please let us know as to how we can store the CRL online and access the same during certificate validation?

Hui Liu-MSFT 48,681 Microsoft External Staff

Hi,@S Abijith. To store Certificate Revocation Lists (CRLs) online and access them during certificate validation, you typically need to have access to a network location where the CRLs are published.Obtain CRL Distribution Points (CDPs):

This information is stored in the CRL Distribution Points (CDPs) extension of the certificate.

You could extract the CDPs from the server's certificate during the validation process.

Download CRLs from CDPs:

Once you have obtained the CDPs from the server's certificate, your application needs to download the corresponding CRLs from these URLs. (use HTTP or other protocols)

Store CRLs Locally: You may need to implement a caching mechanism to avoid downloading the same CRL repeatedly.

Configure X509Chain to Use Online Revocation Checking:

In your ValidateCertificate method, set the RevocationMode of the X509Chain's ChainPolicy to Online to enable online revocation checking.

Sample:


 private bool ValidateCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)

 {

     if (sslPolicyErrors != SslPolicyErrors.None)

     {

         return false;

     }

    

     chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;

     // Cast the certificate to X509Certificate2

     X509Certificate2 certificate2 = certificate as X509Certificate2;

     if (certificate2 == null)

     {

        

         return false;

     }

     

     bool chainIsValid = chain.Build(certificate2);

     if (!chainIsValid)

     {

         return false;

     }

   

     foreach (X509ChainElement chainElement in chain.ChainElements)

     {

         foreach (X509Extension extension in chainElement.Certificate.Extensions)

         {

             if (extension.Oid.FriendlyName.Equals("CRL Distribution Points"))

             {

                 string crlDistributionPoints = extension.Format(false);

              

                 string[] cdpUrls = crlDistributionPoints.Split(new[] { '\n' }, StringSplitOptions.RemoveEmptyEntries);

                 foreach (string cdpUrl in cdpUrls)

                 {

                  

                     try

                     {

                         DownloadAndStoreCrl(cdpUrl);

                     }

                     catch (Exception ex)

                     {

                        

                         Console.WriteLine("Error downloading CRL from " + cdpUrl + ": " + ex.Message);

                     }

                 }

             }

         }

     }

     return true;

 }

 private void DownloadAndStoreCrl(string cdpUrl)

 {

     // Implement logic to download CRL from cdpUrl and store it locally

    

 }

S Abijith 471 Reputation points

2024-06-11T09:28:51.32+00:00

Thank you @Hui Liu-MSFT for your response. This helped us in gaining good insights into CRL validation!!

Your answer

Hui Liu-MSFT 48,681 Reputation points Microsoft External Staff

2024-05-14T09:57:44.64+00:00

Hi,@S Abijith. Welcome to Microsoft Q&A.

To implement Certificate Revocation List (CRL) checking in your WPF application, you could try to use the X509Chain class provided by the System.Security.Cryptography.X509Certificates namespace.

This callback method is called during the SSL/TLS handshake to validate the server's certificate.

private bool ValidateCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) { if (sslPolicyErrors != SslPolicyErrors.None) { return false; } X509Chain certChain = new X509Chain(); certChain.ChainPolicy.RevocationMode = X509RevocationMode.Online; // Enable CRL check bool chainIsValid = certChain.Build((X509Certificate2)certificate); if (!chainIsValid) { return false; } return true; }

Register the RemoteCertificateValidationCallback method with ServicePointManager.

ServicePointManager.ServerCertificateValidationCallback += ValidateCertificate;
S Abijith 471 Reputation points

2024-05-15T12:27:30.35+00:00

Hi @Hui Liu-MSFT,

Thank you for your response.

In the comment, it is visible that the 'RevocationMode' is set to 'Online'.

Can you please let us know as to how we can store the CRL online and access the same during certificate validation?
S Abijith 471 Reputation points

2024-06-11T09:28:51.32+00:00

Thank you @Hui Liu-MSFT for your response. This helped us in gaining good insights into CRL validation!!

Share via

Certificate Revocation List

Your answer