Enable Managed Certificate Revocation List

Starting from ARTESCA version 4.1.0, fresh installations come with the Managed Certificate Revocation List (MCRL) service enabled by default. This exposes a Certificate Revocation List endpoint to validate certificates issued by the ARTESCA internal Certificate Authority (CA).

The MCRL service requires the crl.<base-domain-name> DNS entry to be configured and reachable from every system validating CRL when using default certificates generated by ARTESCA. Refer to the General DNS Setup section for more information.

Important

During the upgrade to 4.1, the ARTESCA built-in Certificate Authority is renewed. Make sure this new ARTESCA built-in Certificate Authority is trusted by your clients before enabling the MCRL service and renewing the leaf certificates.

If you are upgrading from a version below 4.1.0, you can enable the MCRL service by running the following command after the upgrade is complete.

[artesca-os@bootstrap ~]$

sudo ./artesca-installer configure-mcrl

To get the leaf certificates properly configured with a CRL reference, you need to renew the leaf certificates following the Force Renew ARTESCA Built-In Certificate procedure.