# CRL Freshness & Drift Monitor (`monema/crl-freshness-drift-monitor`) Actor Monitor public X.509 certificate revocation lists for expiry, publication drift, issuer changes, and revoked-certificate set changes across scheduled runs. - **URL**: https://apify.com/monema/crl-freshness-drift-monitor.md - **Developed by:** [Maarten Vreeburg](https://apify.com/monema) (community) - **Categories:** Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing $3.00 / 1,000 successful crl checks This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## CRL Freshness & Drift Monitor Monitor public X.509 certificate revocation lists (CRLs) for expiry risk, publication changes, issuer/key-identifier drift, and revoked-certificate set changes. The Actor is designed for PKI, identity, infrastructure, and security teams that need a schedule-ready external check of public CRL distribution points. ### What it does For each CRL URL, the Actor: 1. fetches a bounded public HTTP(S) endpoint; 2. parses DER or PEM X.509 CRL data; 3. reports `thisUpdate`, `nextUpdate`, issuer, CRL number, delta-CRL indicator, authority key identifier, signature algorithm, and revocation counts; 4. classifies freshness as `healthy`, `expiring`, `expired`, `not_yet_valid`, or `no_next_update`; 5. compares the normalized CRL with the prior successful check in a named key-value store; and 6. emits one structured dataset row with `initial_snapshot`, `unchanged`, or `changed`. Failed fetches, malformed CRLs, issuer mismatches, and oversized CRLs do not replace a known-good baseline and are not charged as successful checks. ### Input ```json { "monitorId": "production-pki", "targets": [ { "label": "DigiCert Global Root G2 CRL", "crlUrl": "http://crl3.digicert.com/DigiCertGlobalRootG2.crl" }, { "label": "Corporate issuing CA", "crlUrl": "https://pki.example.com/issuing-ca.crl", "expectedIssuer": "CN=Example Issuing CA,O=Example Corp,C=US" } ], "warningHours": 72, "timeoutSeconds": 30, "maxConcurrency": 3 } ```` Use the same `monitorId` for scheduled runs that should share history. `expectedIssuer` is an optional exact RFC 4514 string; omit it until you have copied the `issuer` value from a successful row. ### Output Important fields include: - `status`, `crl_health`, `requirements_status`, and `update_pattern` - `issuer`, `this_update`, `next_update`, and `hours_until_next_update` - `crl_number`, `delta_base_crl_number`, and `authority_key_identifier` - `revoked_certificate_count`, `revoked_entries_sha256`, and reason counts - added/removed/modified revoked-serial counts and bounded detail - `content_hash`, `previous_hash`, and `state_store_mode` - structured change records with review priorities `routine_republication` means signed publication metadata changed while the normalized revoked set and issuer/authority identity did not. `revoked_set_changed` means serial membership or revocation metadata changed. These labels are review aids, not proof that a CA operation is safe or unsafe. ### Persistence The Actor stores successful normalized snapshots in the explicit named key-value store: ```text crl-freshness-drift-monitor-state-v1 ``` Keys are SHA-256 derivations of `monitorId` plus `crlUrl`. The default run-scoped store is not used as cross-run memory. ### Pricing behavior The custom pay-per-event event is `crl_check`. It is emitted only after a CRL is fetched, parsed, compared, and stored successfully. Errors are written to the dataset without the custom charge. ### Security and operating limits - 1–100 targets; maximum 5 concurrent requests - public HTTP(S) URLs only; URL credentials and fragments rejected - standard ports 80/443 only - private, loopback, link-local, multicast, and reserved destinations blocked - every redirect destination is resolved and validated; the connection is pinned to a validated address - maximum 5 redirects and 2 bounded attempts - compressed HTTP responses rejected - 6 MB response limit - maximum 50,000 revoked-certificate entries - 60-second maximum timeout per target - failed observations never overwrite a successful baseline HTTP is supported because many CRL distribution points are intentionally published over HTTP. X.509 CRLs are signed objects, but **this Actor does not verify the CRL signature** because it does not accept an issuer-certificate trust input. It parses the signed fields and reports `signature_verified: false`. Use a trusted PKI validator and the issuer certificate when cryptographic authenticity is required. The Actor does not query LDAP distribution points, OCSP responders, private/internal URLs, or authenticated endpoints. Polling can miss a CRL that changed and reverted between runs. Apify schedules/webhooks provide automation primitives; the Actor is not a complete PKI monitoring or incident-response system. ### Local development ```bash python -m venv .venv . .venv/bin/activate pip install -r requirements.txt python smoke_test.py npx --yes apify-cli validate-schema npx --yes apify-cli run --purge ``` ### Independent product notice This is an independent monitoring utility. It is not affiliated with, endorsed by, or operated by DigiCert, Microsoft, GlobalSign, any certificate authority, browser vendor, or PKI platform. Public names in examples identify public CRL sources only. Verify material PKI decisions against the CA's official documentation and your organization's trust policy. # Actor input Schema ## `monitorId` (type: `string`): Stable ID for this independent CRL watchlist. ## `targets` (type: `array`): Each target needs a public HTTP or HTTPS URL returning a DER or PEM X.509 CRL. ## `warningHours` (type: `integer`): Mark a CRL for review when nextUpdate is within this many hours. ## `timeoutSeconds` (type: `integer`): Timeout for each CRL request. ## `maxConcurrency` (type: `integer`): Number of CRL targets processed in parallel. ## Actor input object example ```json { "monitorId": "qa-default", "targets": [ { "label": "DigiCert Global Root G2 CRL", "crlUrl": "http://crl3.digicert.com/DigiCertGlobalRootG2.crl" } ], "warningHours": 72, "timeoutSeconds": 30, "maxConcurrency": 3 } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "targets": [ { "label": "DigiCert Global Root G2 CRL", "crlUrl": "http://crl3.digicert.com/DigiCertGlobalRootG2.crl" } ] }; // Run the Actor and wait for it to finish const run = await client.actor("monema/crl-freshness-drift-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "targets": [{ "label": "DigiCert Global Root G2 CRL", "crlUrl": "http://crl3.digicert.com/DigiCertGlobalRootG2.crl", }] } # Run the Actor and wait for it to finish run = client.actor("monema/crl-freshness-drift-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "targets": [ { "label": "DigiCert Global Root G2 CRL", "crlUrl": "http://crl3.digicert.com/DigiCertGlobalRootG2.crl" } ] }' | apify call monema/crl-freshness-drift-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=monema/crl-freshness-drift-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "CRL Freshness & Drift Monitor", "description": "Monitor public X.509 certificate revocation lists for expiry, publication drift, issuer changes, and revoked-certificate set changes across scheduled runs.", "version": "0.1", "x-build-id": "f8ZHoEmonGwhM7X1X" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/monema~crl-freshness-drift-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-monema-crl-freshness-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/monema~crl-freshness-drift-monitor/runs": { "post": { "operationId": "runs-sync-monema-crl-freshness-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/monema~crl-freshness-drift-monitor/run-sync": { "post": { "operationId": "run-sync-monema-crl-freshness-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "monitorId", "targets" ], "properties": { "monitorId": { "title": "Monitor ID", "minLength": 1, "maxLength": 200, "type": "string", "description": "Stable ID for this independent CRL watchlist.", "default": "qa-default" }, "targets": { "title": "CRL targets", "minItems": 1, "maxItems": 100, "type": "array", "description": "Each target needs a public HTTP or HTTPS URL returning a DER or PEM X.509 CRL.", "items": { "type": "object", "properties": { "label": { "title": "Internal label", "type": "string", "description": "Optional CA, environment, application, or owner label.", "maxLength": 200 }, "crlUrl": { "title": "CRL URL", "type": "string", "description": "Public HTTP(S) URL returning a DER or PEM X.509 certificate revocation list.", "minLength": 1, "maxLength": 2048 }, "expectedIssuer": { "title": "Expected issuer DN", "type": "string", "description": "Optional exact RFC 4514 issuer string. A mismatch is non-billable and does not replace the baseline.", "maxLength": 4000 } }, "required": [ "crlUrl" ] }, "default": [ { "label": "DigiCert Global Root G2 CRL", "crlUrl": "http://crl3.digicert.com/DigiCertGlobalRootG2.crl" } ] }, "warningHours": { "title": "Freshness warning window (hours)", "minimum": 1, "maximum": 2160, "type": "integer", "description": "Mark a CRL for review when nextUpdate is within this many hours.", "default": 72 }, "timeoutSeconds": { "title": "Request timeout (seconds)", "minimum": 5, "maximum": 60, "type": "integer", "description": "Timeout for each CRL request.", "default": 30 }, "maxConcurrency": { "title": "Maximum concurrent checks", "minimum": 1, "maximum": 5, "type": "integer", "description": "Number of CRL targets processed in parallel.", "default": 3 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```