Revocation Monitoring

From the Revocation Monitoring page in the Keyfactor Command Management Portal, you can manage CRLClosed A Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their scheduled expiration date and should no longer be trusted. and OCSP endpoints used for revocation monitoring. This includes adding, editing, deleting, and testing endpoints, as well as monitoring endpointClosed An endpoint is a URL that enables the API to gain access to resources on a server. responsiveness and configuring email alert notifications.

CRL monitoring provides visibility into endpoint availability (for example, missing files or unreachable locations), upcoming expiration, and expired CRLs. Alert timing is based on the CRL expiration date (not the Next Publish date), allowing you to define what constitutes a stale CRL. When email notifications are triggered, corresponding events are also written to the Windows event log on the Keyfactor Command server (Windows installations only).

OCSP monitoring is limited to endpoint responsiveness. Expiration is not applicable.

Tip:  Where to find this in the Management Portal:
Alerts → Revocation Monitoring
Note:  Revocation monitoring supports delivering alerts using either the legacy alerting system or the newer workflowClosed A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. system. The workflow system offers more options for injecting actions in the process than the legacy alerting system. To configure an alert to use the workflow system for alerting, set Use Workflows On and create a workflow for the alert (see details below).

When the alerts are run using workflow, there are two Keyfactor Command service jobs that perform this function. The first, running as scheduled for the alerts (see the Monitoring Execution Schedule for each alert), gathers any expiring or unreachable revocation monitoring endpoints that meet the alert criteria. The second, running every 10 minutes, takes the collected revocation monitoring endpoints and generates workflow instances for each.

  1. On the Revocation Monitoring page, click Add from the toolbar to create a new alert, or Edit from either the toolbar or right click menu, to modify an existing one.

  2. In the Revocation Endpoint Settings dialog, type a Display Name. This name appears on the Revocation Monitoring grid and on the legacy dashboard.

  3. In the Endpoint Type dropdown, choose either CRL or OCSP.

  4. In the Monitoring Execution Schedule section, configure a monitoring execution schedule. This defines the frequency with which locations are checked and alerts sent. You can choose to schedule the alert for this location either for daily delivery at a specified time or at intervals of anywhere from every 1 minute to every 12 hours. A daily schedule is the most common configuration. The schedule is set for each endpoint.

    Tip:  Users with only the Schedule or Schedule > Revocation permissions for alert monitoring and not Modify permissions will only be able to edit the Monitoring Execution Schedule and not other fields on the settings dialog.

  5. Choose how alerts are delivered. Turn on or off Use Workflows as needed depending on how you want alerts delivered.

    • If Use Workflows is turned on (workflow-based alerting):

      1. Select an option in the Workflow Definitions dropdown. You can either choose an existing workflow or select Add New Workflow.

        Figure 189: Create a Revocation Monitoring Alert with Workflow Option

      2. For a CRL location, in the Workflow Schedule (CRL only) section, configure the time when workflow will begin executing for the alert. Turn on the Workflow start option and set the number of days ahead of expiration that workflow for this alert should run.

      3. Save the alert.

        If you select Add New Workflow, saving the alert creates a new workflow with the same name as the expiration alert. The workflow workspace opens automatically so you can add steps.

      4. Add one or more workflow steps, such as:

    • If Use Workflows is turned off (legacy alerting):

      Continue with the following steps to configure legacy alert settings.

      1. For a CRL location, in the Email Reminder (CRL only) section, configure the time when the alert will begin executing. Turn on the Warn option and set the number of days ahead of expiration that email reminders should begin to be sent.

      2. In the Recipients grid, click Add to create a new recipient entry. Enter the email addresses of users or groups who should receive notifications when OCSP or CRL endpoints are approaching expiration or are unreachable. Recipient lists are configured for each endpoint.

        You can also edit or delete a recipient by selecting a row in the Recipients grid and using the action buttons on the toolbar.

        Tip:  Keyfactor Command sends SMS (text) messages by leveraging the email to text gateways that many major mobile carriers provide. Check with your carrier for specific instructions. Keyfactor has tested that AT&T can be addressed using 10-digit-number@txt.att.net (for example, 4155551212@txt.att.net) and Verizon can be addressed using 10-digit-number@vtext.com (for example, 2125551212@vtext.com). T-Mobile can be addressed using 10-digit-number@tmomail.net (for example, 2065551212@tmomail.net), but functionality can be spotty. Reliability of alerting via this method depends on the reliability of the carrier’s gateways.

        Figure 190: Revocation Monitoring Legacy Configuration

  6. To test the value entered in the Location field to determine if the referenced CRL or OCSP URL can be reached without saving the alert, click Test Connection. To save the alert and test the value in the Location field at the same time, click Test and Save. Records can be saved even if the test fails. Click Cancel to cancel.

    Note:  The test steps available as part of adding or editing a revocation monitoring alert record do not test whether the CRL or OCSP endpoint is valid. They only test whether a CRL or OCSP endpoint exists at the specified location.

For alerts that use workflow, you can open the associated workflow for the alert using the Configure Workflow option.

  1. On the Revocation Monitoring page, select a row in the alerts grid, and click Configure Workflow from the toolbar or right-click menu.
  2. You will be redirected to the workflow workspace for the workflow associated with the selected alert. If a workflow does not exist for the selected alert, one will be created and pre-populated with the Name, Type, and Revocation Monitoring Alert (key) of the selected alert. Edit the workflow as needed (see Add, Copy, or Modify a Workflow Definition).
Note:  This option will not appear in the right-click menu and will be inactive on the toolbar for alerts that do not use workflow.
  1. On the Revocation Monitoring page, select a row in the grid, and click Delete from the toolbar or right-click menu.
  2. On the Confirm Operation alert, click OK to confirm or Cancel to cancel the operation.
  1. On the Revocation Monitoring page, select a location from the grid, and click Test from the toolbar or the right-click menu.
  2. In the Revocation Monitoring Test dialog, select a Start Date for the alert test. For a CRL endpoint, this would be the date to compare against the configured warning period for email reminders and expiration date for the CRL. You can use this option to simulate running the alerts a month from now, for example, to be sure you pick up some expiring CRLs for testing purposes. The date for OCSP endpoints is not significant since these are testing only for the accessibility and validity of the endpoint. For alerts that do not use workflow, turn on Send Emails if you would like to deliver email messages as part of the test. Alerts that do use workflow will generate a workflow instance for the selected alert.
  3. Click the Start Tests button to generate the test alert.

  4. In the Revocation Monitoring Test: Results dialog, you can review the generated alert to confirm that the alert and the recipients are as expected. Scroll the First, Previous, Next, and Last buttons at the bottom of the dialog. The number of alerts generated will display between the navigation buttons.

    Note:  The display results will vary depending on whether the alert uses workflow to deliver the alerts or the legacy alerting system.
Tip:  Alerts are generated when a CRL is expired or in the warning period as defined by the number of days configured in the Email Reminder setting. For example, if you had a CRL that expired on June 30 and configured the email reminder period to 15 days before expiration, the warning status would begin for that CRL on June 15 and CRL alerts would be generated. A warning will also appear for any CRL or OCSP locations that produced an error or couldn’t be resolved.

Figure 191: Revocation Monitoring Test Results With and Without Workflow

Tip:  Click the help icon () next to the Revocation Monitoring page title to open the Keyfactor Software & Documentation Portal to this section. You will receive a prompt indicating:

You are being redirected to an external website ‘software.keyfactor.com'. Would you like to proceed?

You can also find Help in the NavigatorClosed The Navigator is the Keyfactor Command left-hand (newer versions) or top (older versions) navigation menu. Certificate collections and reports can be configured to be added to the menu using user-defined Show in Navigator settings.. From here you can choose to open either the Keyfactor Software & Documentation Portal at the home page or the Keyfactor API Endpoint Utility.

Keyfactor provides two sets of documentation: the On-Premises Documentation Suite and the Managed Services Documentation Suite. Which documentation set is accessed is determined by the Application Settings: On-Prem Documentation setting (see Application Settings: Console Tab).