Added some docs for allow_expired_crl

As mentioned on the mailing list today: omission might confuse people

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index d7200515148ed9e230d24d43bad28dfc5268e77e..b7c8d494aa9ec3a09ce973550c91c840b40deeaa 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -292,6 +292,10 @@ eap {
 
                ca_path = ${cadir}
 
+               # Accept an expired Certificate Revocation List
+               #
+#              allow_expired_crl = no
+
                #
                #  If check_cert_issuer is set, the value will be checked
                #  against the DN of the issuer in the client certificate.  If

diff --git a/raddb/mods-available/eap_inner b/raddb/mods-available/eap_inner
index 2545d8fb96e43f3eab67be8f63f66e19628144a7..a0cee8efc6c51c8ce20c74d23cd8b53c17094c59 100644 (file)
--- a/raddb/mods-available/eap_inner
+++ b/raddb/mods-available/eap_inner
@@ -127,6 +127,10 @@ eap inner-eap {
                ca_path = ${cadir}
 #              check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"
 #              check_cert_cn = %{User-Name}
+
+               # Accept an expired Certificate Revocation List
+               #
+#              allow_expired_crl = no
        }
 
        ## EAP-TLS

diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
index b1df728a6728e82b9a871e2769c460d7f345abc2..0783e6ca158afb647ea1ab42f40fbbe6dd330dff 100644 (file)
--- a/raddb/sites-available/tls
+++ b/raddb/sites-available/tls
@@ -129,6 +129,10 @@ server radsec {
                #       check_crl = yes
                        ca_path = ${cadir}
 
+                       # Accept an expired Certificate Revocation List
+                       #
+               #       allow_expired_crl = no
+
                        #
                        #  If check_cert_issuer is set, the value will
                        #  be checked against the DN of the issuer in