Skip to main content

How To: Manage Certificate Revocation Lists (CRL)

Certificate Revocation List (CRL)

A certificate revocation list (CRL) is a blacklist of certificates signed by the issuer (CA). The issuer has declared these certificates invalid before their regular expiry date. The reason for this can be a compromised private key or a replaced certificate, for example. When an encrypted connection is being established, the runtime system checks the cross-certificate not only for its validity period but also against the CRL of the respective issuer. If the cross-certificate is on the list, then the runtime system will reject it. Each CRL has a "Last Update" and a "Next Update". The last update is the date of issue. The next update is the time that the issuer has provided for the next update of the list. After this time, the CRL is considered outdated and must be renewed.

The source of the CRLs is the respective issuer (CA). The CRLs are provided by the issuer and managed in the Security Agent.

Status indicators

The Security Agent highlights the existing CRLs according to their status in color:

  • Green: The CRL is valid (less than 2/3 of the update interval has elapsed).

  • Yellow: Updating the CRL is recommended (at least 2/3 or more of the update interval has elapsed).

  • Orange: Updating the CRL is urgent (at least 90% or more of the update interval has elapsed).

  • Red: The CRL is outdated (the Next Update is in the past).

Loading the CRL to the device

. Requirements

  • The project is connected to the controller with runtime system ≥ V3.5 SP22.

  • The CODESYS Security Agent add-on is installed.

  1. Click the View → Security Screen command.

  2. Click the Devices tab and then click the refresh button (_csa_icon_refresh.png).

  3. On the left side, select the corresponding device.

  4. Select the Revocation Lists folder.

  5. Click the _csa_icon_download_cert.png button. Select the .crl certificate revocation list from the file system which you want to import and click Open.

    The CRL will be loaded to the controller and displayed in the right side of the open editor. All previously imported CRLs are displayed on the right side.

Backing up a CRL from the device

  1. On the right side, select the desired CRL.

  2. Click on the _csa_icon_upload_cert.png icon to save the selected CRL to the PC.

  3. In the Save As dialog, select the path and file name (default: <issuer>.crl) and click OK to confirm.

Deleting a CRL from the device

  1. On the right side, select the desired CRL.

  2. Click on the _cds_icon_breakpoint_delete.png icon to delete the selected CRL.

  3. For security reasons, confirm the prompts.

In this section: