ACME, CRL, and OCSP

AD-PKI issues certificates automatically through the ACME protocol and publishes revocation status via CRL and OCSP. This chapter covers the practical use of all three interfaces.

ACME

The CA core exposes an ACME endpoint compatible with standard clients such as certbot or acme.sh. The directory URL is:

https://<your-adpki-domain>/acme/directory

Which intermediate CA signs ACME requests is configured in the web interface under Security → ACME via the active-intermediate dropdown.

Certificate via HTTP-01 challenge

With the HTTP-01 challenge the client proves control over the domain over HTTP. Port 80 must be free for this (--standalone):

sudo certbot certonly \
  --server https://<your-adpki-domain>/acme/directory \
  --standalone \
  --domain adpki.danakiran.de \
  --agree-tos \
  --email admin@firma.de \
  --non-interactive

Wildcard certificate via DNS-01 challenge

Wildcard certificates (*.domain) are only possible through the DNS-01 challenge. The TXT record shown by the client must be added to the DNS zone:

sudo certbot certonly \
  --server https://<your-adpki-domain>/acme/directory \
  --manual \
  --preferred-challenges dns \
  --domain "*.danakiran.de" \
  --agree-tos \
  --email admin@firma.de

Automatic renewal

ACME certificates are short-lived and renewed automatically. The scheduler set up by the installer (php artisan schedule:run, run every minute via cron) handles server-side tasks. On the client side, certbot renew renews pending certificates:

sudo certbot renew --server https://<your-adpki-domain>/acme/directory

CRL (Certificate Revocation List)

The revocation list contains every revoked serial number of an issuing CA. Clients download it periodically to check whether a certificate is still valid.

The CRL distribution point is embedded into every issued certificate and can be fetched directly:

Download the CRL:

curl -o adpki.crl http://<your-adpki-domain>/api/crl/<intermediate-id>.crl

Inspect its contents:

openssl crl -in adpki.crl -inform DER -text -noout

The CRL is re-signed and republished after every revocation as well as at regular intervals. Schedule fetches so the Next Update time is never exceeded.

OCSP (Online Certificate Status Protocol)

OCSP returns the revocation status of a single certificate in real time, without having to download the full CRL. The OCSP responder URL is also embedded into issued certificates.

Check a certificate’s status:

openssl ocsp \
  -issuer intermediate.crt \
  -cert server.crt \
  -url http://<your-adpki-domain>/api/ocsp \
  -resp_text

The result reports one of the states good, revoked, or unknown. For revoked it additionally returns the revocation time and, if available, the revocation reason.

CRL or OCSP?

Property	CRL	OCSP
Scope	entire list	single certificate
Freshness	periodic (Next Update)	near real time
Bandwidth	higher (full list)	low per request
Works offline	yes (cached)	no (responder required)

In practice the two complement each other: OCSP for fast individual checks, CRL as a robust fallback. Both are provided automatically by the AD-PKI CA service and only need to be reachable.