checkId: check.timestamp.crl.distribution plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, crl, distribution, revocation, air-gap]

CRL Distribution Point Availability

This Stella Ops Doctor check verifies that the CRL (Certificate Revocation List) distribution points used to validate timestamping authority (TSA) certificates are reachable. It is most relevant to operators running policy-gated, eIDAS-aware, or air-gapped release pipelines, where revocation data must stay current for evidence to remain verifiable.

What It Checks

Verifies that configured CRL distribution points are accessible. The check:

Reads the configured CDPs from the registry.
Sends a HEAD request to each CDP URL with a 30-second timeout.
Reports response status, latency, and CRL size (from Content-Length).
Fails if all CDPs are unavailable; warns if some are unavailable.
Passes (Healthy) if no CDPs are configured (the feature is optional).

Air-Gap Behavior

When the deployment is sealed by AirGap policy, or STELLAOPS_DOCTOR_OFFLINE_PROFILE=true forces Doctor offline mode, Doctor does not contact external CRL distribution points. Instead, the check consults the typed offline-kit artefact registry (IAirGapArtefactStore) keyed by SHA-256 of the distribution-point URI (crl/<sha256-of-dp-uri>.crl). For each configured CDP, the check emits a Healthy sub-result when the CRL is shipped and nextUpdate has not lapsed; the parent result reports the canonical evidence rows airGapSealed=true, source=offline-kit, artefactSha256=…, artefactIssuedAt=…. When no CRLs are shipped for any configured CDP, the check fails closed (source=offline-kit-missing).

The CRL cache TTL is 1 hour, or shorter when CRL nextUpdate requires it. Manifest tampering is detected on every read (SHA-256 verification).

Why It Matters

CRL distribution points provide certificate revocation lists needed to verify that TSA certificates have not been revoked. If CDPs are unavailable, the system cannot download updated CRLs, potentially accepting timestamps from revoked certificates.

Common Causes

CRL distribution point server is down
Network connectivity issues
Firewall blocking HTTP/HTTPS to CDP URLs
CDP URL changed by the CA

How to Fix

Docker Compose

docker exec <platform-container> curl -I http://crl.example.com/crl.pem

Bare Metal / systemd

# Test CDP connectivity
curl -I http://crl.example.com/crl.pem

# Check network and DNS
nslookup crl.example.com

Kubernetes / Helm

Ensure egress NetworkPolicies allow traffic to CRL distribution point URLs.

Verification

stella doctor run --check check.timestamp.crl.distribution

OCSP Responder Availability (check.timestamp.ocsp.responder) — checks OCSP responder availability
Revocation Cache Freshness (check.timestamp.revocation.cache-fresh) — checks revocation cache freshness