# X-Pack and CRL

**URL:** <https://discuss.elastic.co/t/x-pack-and-crl/82675>\
**Category:** Elasticsearch\
**Created:** [April 18, 2017, 9:27am UTC](https://discuss.elastic.co/t/x-pack-and-crl/82675 "2017-04-18T09:27:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ricou](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@ricou](https://discuss.elastic.co/u/ricou)\
**Post date:** [April 18, 2017, 9:27am UTC](https://discuss.elastic.co/t/x-pack-and-crl/82675/1 "2017-04-18T09:27:03Z")

</div>

Hello all,

is it possible to configure a CRL with the X-Pack ?  
Or should I validate the certificates before the request is sent to elasticsearch ?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [April 18, 2017, 2:02pm UTC](https://discuss.elastic.co/t/x-pack-and-crl/82675/2 "2017-04-18T14:02:55Z")

</div>

Can you provide more precise details about what you're after?

Is this for use in a `pki` authentication realm, or some other use?

---

<div class="post-metadata">

**Author:** ![ricou](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@ricou](https://discuss.elastic.co/u/ricou)\
**Post date:** [April 18, 2017, 3:45pm UTC](https://discuss.elastic.co/t/x-pack-and-crl/82675/3 "2017-04-18T15:45:43Z")

</div>

Yes, this is for a pki realm configuration.

When you specify a truststore in the configuration file, elasticsearch uses it to validate that the client certificates are signed by a CA that you trust. On the client side too, you can use a truststore to validate the server certificate.

All the certificates that I use contains a CRL Distribution Point where I can get a file containing the serial numbers of all the revoked certificates (the CRL).

On the client side, the TrustManager (java) that I use is validating the server certificates with those CRLs.

Is it possible to do the same thing on the server side ? Maybe not calling a CRLDP, but providing a CRL that will be reloaded periodically ?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [April 24, 2017, 12:07am UTC](https://discuss.elastic.co/t/x-pack-and-crl/82675/4 "2017-04-24T00:07:02Z")

</div>

I'm afraid this isn't currently supported.

If the functionality is important to you, please raise an enhancement request through your sales or support contacts, so that we can understand your requirements clearly and track demand for the feature.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2017, 12:14am UTC](https://discuss.elastic.co/t/x-pack-and-crl/82675/5 "2017-05-22T00:14:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.