# Support for CRL/OCSP in PKI realm?

**URL:** <https://discuss.elastic.co/t/support-for-crl-ocsp-in-pki-realm/201858>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 1, 2019, 7:48pm UTC](https://discuss.elastic.co/t/support-for-crl-ocsp-in-pki-realm/201858 "2019-10-01T19:48:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cozbone43](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cozbone43/32/34642_2.png) [@cozbone43](https://discuss.elastic.co/u/cozbone43)\
**Post date:** [October 1, 2019, 7:48pm UTC](https://discuss.elastic.co/t/support-for-crl-ocsp-in-pki-realm/201858/1 "2019-10-01T19:48:22Z")

</div>

We are looking to start using PKI authentication in our cluster and I'm wondering what options are available to check revocation for client certificates. Are there are any config options in the PKI realm (or even in the JVM settings) that would allow us to point at a CRL or, better yet, an OCSP responder?

Based on similar threads I found for [Logstash](https://discuss.elastic.co/t/client-certificate-revocation/128919) and [Filebeat](https://discuss.elastic.co/t/certificate-revocation-via-clr-or-ocsp/106382), I'm assuming this isn't supported in Elasticsearch at the moment, but I wanted to make sure I'm not just missing something in the documentation.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 4, 2019, 8:23am UTC](https://discuss.elastic.co/t/support-for-crl-ocsp-in-pki-realm/201858/2 "2019-10-04T08:23:26Z")

</div>

This isn't supported.

If it's important to you, and you have access to raise support tickets, then I would encourage you to open a ticket & ask for it to be tracked as an enhancement request.

---

<div class="post-metadata">

**Author:** ![cozbone43](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cozbone43/32/34642_2.png) [@cozbone43](https://discuss.elastic.co/u/cozbone43)\
**Post date:** [October 14, 2019, 1:45pm UTC](https://discuss.elastic.co/t/support-for-crl-ocsp-in-pki-realm/201858/3 "2019-10-14T13:45:01Z")

</div>

Thanks for confirming @TimV! I'll work on an enhancement request.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2019, 1:45pm UTC](https://discuss.elastic.co/t/support-for-crl-ocsp-in-pki-realm/201858/4 "2019-11-11T13:45:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.