The certificate-revocation tag has no wiki summary.
5
votes
0answers
35 views
Force a subordinate CA cert to be signed to include a CRL so clients can more easily check for revocation of the subordinate CA cert?
How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows:
openssl req -new -key /root/ca/private/private.key -out /root/public.csr
I usually sign with:
...
4
votes
2answers
102 views
Why are Certificate Revocation List periodically renewed?
While studying a security course I have been asked this very question:
Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list?
Honestly I can't find the ...
4
votes
1answer
105 views
Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?
Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
2
votes
1answer
86 views
How does an offline CA revoke certificates?
If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs?
From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
3
votes
1answer
98 views
User Groups (Circles) Inside a Web of Trust
Assume I have a universe of U users. Every user has his private key.
I want to build user groups by adding a company sub key to his key set.
Now users can sign his company sub key with there company ...
5
votes
1answer
81 views
Is there any malicious reason to block CRLs?
I've noticed that in order to 'illegally' crack certain applications, it is necessary to patch the host file to stop communication with the activation servers.
I've found that with several ...
5
votes
3answers
139 views
What is a reasonable expiry for user authentication certificates?
This question is about a nearly decentralized P2P system with a centralized certificate authority where users can authenticate and receive a certificate on their public key and then can authenticate ...
0
votes
1answer
81 views
Does S/MIME provide means to propagate a certificate's revocation?
Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
2
votes
2answers
184 views
Ssl certificate rekey or revoke
I want to be sure to understand well the situation where SSL certificate is compromised.
If I ask for a rekey, I suppose the old certificate will remain valid.
The future communications with the new ...
2
votes
3answers
85 views
Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?
My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely.
Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
2
votes
1answer
59 views
Is it a good idea to generate certificate-specific CRLs? What is this technique called?
Suppose I create 3 certificates with the following CRLs
Cert1 http://crl.server.com/batch1/root1.crl
Cert2 http://crl.server.com/batch2/root2.crl
Cert3 ...
2
votes
1answer
218 views
What should a CRL file name look like when “new” and “delta” CRLs are generated?
I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated.
When I created the ...
2
votes
1answer
181 views
What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)
I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks.
I understand that clients may not validate the ...
3
votes
2answers
298 views
Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?
Suppose I have several independent PKIs that are used
Two internal PKIs: One with SHA1 support the other with Suite B algorithms.
A partner who I trust and have a policy map with.
Since both my ...
1
vote
1answer
201 views
When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?
When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism?
Related information on a different answer
Consider using HTTP instead ...
4
votes
1answer
538 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
2
votes
2answers
160 views
distribution mechanisms for CRLs
From the X.509 RFC:
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer ...
2
votes
2answers
268 views
Revoked certificate validation using past times
I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past.
Unfortunately I have problems verifying revoked ...
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
1
vote
1answer
159 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
2
votes
2answers
82 views
Does it make sense that OCSP returns state for the signer CA itself
I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
8
votes
1answer
222 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
10
votes
4answers
664 views
Why isn't OCSP required by default in browsers?
According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers.
Can someone please explain why this isn't ...
