For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?

Question

I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL".

Background:

1. I am deploying an application to a private network, but I still need to use SSL for some of the authentication mechanisms. I was thinking that an SSL cert from a standard CA would not work since there is no outside access from within the network, and therefore no way to verify the cert in some way (if verification occurs at all).
2. Service clients would be connecting a variety of ways... browsers, java, .Net, etc... I'd hate to degrade the utility of SSL by turning off features, but I'll keep that as an option.
3. If verification does occur, I think I'll need to deploy my own certificate authority (I realize this would involve distributing a root certificate to all the clients, it's not ideal, but it should be acceptable), but I can't seem to find any information on a "verification provider".

Answer 1

When a SSL connection occurs, the client must make sure that it is talking to the right server. This entails validating the server's certificate with regards to a set of known trust anchors (aka "root certificates"), and also verifying the revocation status of the said certificates (the server's certificate, and every needed intermediate CA certificate between a root and the server's certificate). Revocation is the way a CA says "whoops, my bad, ignore that certificate if you see it, even if it has a seemingly correct signature on it". Revocation status is obtained by downloading a CRL from the CA, where CRL are regularly updated signed objects issued by the CA (typically once per day).

(Alternatively, revocation status can be obtained with OCSP, which does not susbtantially change the picture.)

So revocation status check normally implies some sort of connection to the issuing CA (possibly an intermittent connection or an active regular push from the CA). In some setups, you could do without revocation; this is equivalent to stating that the server's private key will never be stolen.

If the server requests a certificate from the client, the mirror scenario occurs as well.