Add Certificate Revocation List (CRL) support

Signed-off-by: charanck9 <charan.ulasala.ext@ericsson.com>

Author: charanck9

.chloggen/configtls-crl-support.yaml

@@ -0,0 +1,28 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/otlp)
+component: pkg/config/configtls
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add support for checking peer certificates against a Certificate Revocation List (CRL).
+
+# One or more tracking issues or pull requests related to the change
+issues: [12997]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  New `crl_file` and `crl_reload_interval` options allow configuring a PEM-encoded CRL that peer
+  certificates are checked against during the TLS handshake, aborting the handshake on a revoked
+  certificate.
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user, api]

config/configtls/README.md

@@ -81,6 +81,48 @@ Additionally certificates may be reloaded by setting the below configuration.
    Accepts a [duration string](https://pkg.go.dev/time#ParseDuration),
    valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
 
+## CRL (Certificate Revocation List) Configuration
+
+CRL checking can be enabled to verify that peer certificates have not been
+revoked. When a CRL is configured, every peer certificate presented during
+the TLS handshake is checked against the revocation list. If a revoked
+certificate is found, the TLS handshake is aborted.
+
+- `crl_file`: Path to a CRL file in PEM format. (optional)
+
+- `crl_reload_interval` (optional): Specifies the duration after which the CRL file will be
+   reloaded from disk. If not set, the CRL is loaded once at startup and never refreshed.
+   Accepts a [duration string](https://pkg.go.dev/time#ParseDuration),
+   valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
+
+Example (client with CRL checking):
+```yaml
+exporters:
+  otlp:
+    endpoint: myserver.local:55690
+    tls:
+      ca_file: ca.crt
+      cert_file: client.crt
+      key_file: client.key
+      crl_file: revoked-certs.pem
+      crl_reload_interval: 1h
+```
+
+Example (server with CRL checking):
+```yaml
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: mysite.local:55690
+        tls:
+          cert_file: server.crt
+          key_file: server.key
+          client_ca_file: client-ca.crt
+          crl_file: revoked-certs.pem
+          crl_reload_interval: 30m
+```
+
 How TLS/mTLS is configured depends on whether configuring the client or server.
 See below for examples.