title: Configuring Tomcat to check CRL Distribution Points
body: <p>I'm writing a webapp which requires incoming connections to use client certificates for security.  I've set it up to only accept secure connections, and to use clientAuth=true.</p>
  
  <p>I've been trying to check that it rejects certificates which have been revoked, but it doesn't seem to be checking the CRL.  This is the first time I've really tried using CRLs so it's possible/likely I've done something wrong...</p>
  
  <p>Test setup:</p>
  
  <ol>
  <li>created test CA in openssl which has been added to the truststore
  for the server</li>
  <li>created CRL for CA, and added config settings to openssl to include a crl distribution point in client certificates (using
  <a href="https://stackoverflow.com/questions/11966123/howto-create-a-certificate-using-openssl-including-a-crl-distribution-point">Howto create a certificate using openssl including a CRL distribution point?</a>)</li>
  <li>created two client certificates using CA</li>
  <li>revoked one of the client certs, updated crl and placed it in address specified as distribution point (have since checked the
  contents of this CRL and it does list ID of cert as revoked)</li>
  </ol>
  
  <p>After setting this up, I've tried making connections to the application using both certificates, however it lets both connect successfully, even though one of them is revoked?</p>
  
  <p>Is there a setting I've missed in Tomcat that makes it check the CRL distribution point when it receives a client certificate?  I would have thought that would be default behaviour.  </p>
  
  <p>I've found various references to settings which allow you to embed a crl location into the Connector in tomcat - that isn't what I'm looking for.  This system will eventually be configured to accept certificates from a number of different CAs.</p>