Tagged Questions
2
votes
1answer
75 views
How does an offline CA revoke certificates?
If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs?
From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
5
votes
3answers
136 views
What is a reasonable expiry for user authentication certificates?
This question is about a nearly decentralized P2P system with a centralized certificate authority where users can authenticate and receive a certificate on their public key and then can authenticate ...
0
votes
1answer
69 views
Does S/MIME provide means to propagate a certificate's revocation?
Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
2
votes
3answers
76 views
Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?
My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely.
Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
2
votes
1answer
54 views
Is it a good idea to generate certificate-specific CRLs? What is this technique called?
Suppose I create 3 certificates with the following CRLs
Cert1 http://crl.server.com/batch1/root1.crl
Cert2 http://crl.server.com/batch2/root2.crl
Cert3 ...
2
votes
1answer
186 views
What should a CRL file name look like when “new” and “delta” CRLs are generated?
I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated.
When I created the ...
2
votes
1answer
162 views
What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)
I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks.
I understand that clients may not validate the ...
3
votes
2answers
241 views
Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?
Suppose I have several independent PKIs that are used
Two internal PKIs: One with SHA1 support the other with Suite B algorithms.
A partner who I trust and have a policy map with.
Since both my ...
1
vote
1answer
191 views
When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?
When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism?
Related information on a different answer
Consider using HTTP instead ...
4
votes
1answer
477 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
2
votes
2answers
148 views
distribution mechanisms for CRLs
From the X.509 RFC:
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer ...
10
votes
3answers
157 views
Domain name expiration and TLS
If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
1
vote
1answer
155 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
2
votes
2answers
82 views
Does it make sense that OCSP returns state for the signer CA itself
I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
8
votes
1answer
215 views
Why can the validity of an SSL certificate exceed the registration period of a domain?
I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
