# CRL or OCSP in Elastic Stack

**URL:** <https://discuss.elastic.co/t/crl-or-ocsp-in-elastic-stack/277557>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [July 1, 2021, 1:12pm UTC](https://discuss.elastic.co/t/crl-or-ocsp-in-elastic-stack/277557 "2021-07-01T13:12:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rysiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rysiu/32/61919_2.png) [@Rysiu](https://discuss.elastic.co/u/Rysiu)\
**Post date:** [July 1, 2021, 1:12pm UTC](https://discuss.elastic.co/t/crl-or-ocsp-in-elastic-stack/277557/1 "2021-07-01T13:12:21Z")

</div>

Hi,

I have a question that relates to the October 2019 thread:

> [@Support for CRL/OCSP in PKI realm?](https://discuss.elastic.co/t/support-for-crl-ocsp-in-pki-realm/201858):
>
> We are looking to start using PKI authentication in our cluster and I'm wondering what options are available to check revocation for client certificates. Are there are any config options in the PKI realm (or even in the JVM settings) that would allow us to point at a CRL or, better yet, an OCSP responder? Based on similar threads I found for [Logstash](https://discuss.elastic.co/t/client-certificate-revocation/128919) and [Filebeat](https://discuss.elastic.co/t/certificate-revocation-via-clr-or-ocsp/106382), I'm assuming this isn't supported in Elasticsearch at the moment, but I wanted to make sure I'm not just missing something in the d…

The topic was also brought up:

> <https://github.com/elastic/logstash/issues/11602>
>
> As it stands today Logstash does not check if a certificate has been revoked. Th…is means if a certificate has been compromised, the entire trust chain may need to be replaced. To simplify the security response, honoring a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) will be an enormous help.
> 
> JRuby's SSL libraries already supports this:
> https://github.com/jruby/jruby-openssl/pull/124

When configuring SSL/TLS in Elasticsearch, is it possible to somehow add support for CRL or OCSP so that the system automatically performs PKI certificate revocation detection?

Is there currently no support for CRL or OCSP?  
Is there support for CRL or OCSP in some paid subscription version?

---

<div class="post-metadata">

**Author:** ![Rysiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rysiu/32/61919_2.png) [@Rysiu](https://discuss.elastic.co/u/Rysiu)\
**Post date:** [July 6, 2021, 6:40am UTC](https://discuss.elastic.co/t/crl-or-ocsp-in-elastic-stack/277557/2 "2021-07-06T06:40:24Z")

</div>

Any idea? 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2021, 6:40am UTC](https://discuss.elastic.co/t/crl-or-ocsp-in-elastic-stack/277557/3 "2021-08-03T06:40:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.