Certificate Revocation is a process through which we make sure that those certificates that are not considered valid are not used by relying parties.

learn more… | top users | synonyms

12
votes
3answers
206 views

Domain name expiration and TLS

If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration ...
10
votes
4answers
908 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...
8
votes
1answer
291 views

Why can the validity of an SSL certificate exceed the registration period of a domain?

I can understand why one might desire to purchase a certificate for multiple years but I am left wondering why it appears to be possible to obtain a valid certificate for a domain that may have come ...
8
votes
1answer
398 views

Force a subordinate CA cert to be signed to include a the CRL distribution point extension?

How can I attach a crlDistributionPoints parameter when signing a CSR I've generated as follows: openssl req -new -key /root/ca/private/private.key -out /root/public.csr I usually sign with: ...
7
votes
1answer
92 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
5
votes
3answers
245 views

Why does OpenSSL need the private key to revoke a certificate?

openssl ca -revoke signed/0A.pem -config caconfig.cnf What does this do which requires the CA's private key? Does it do anything except updating index.txt?
5
votes
3answers
663 views

Why are Certificate Revocation List periodically renewed?

While studying a security course I have been asked this very question: Why are CRL periodically renewed, even if there are no new revoked certificates to add to the list? Honestly I can't find the ...
5
votes
3answers
356 views

Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?

Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
5
votes
3answers
235 views

What is a reasonable expiry for user authentication certificates?

This question is about a nearly decentralized P2P system with a centralized certificate authority where users can authenticate and receive a certificate on their public key and then can authenticate ...
5
votes
1answer
292 views

Is there any malicious reason to block CRLs?

I've noticed that in order to 'illegally' crack certain applications, it is necessary to patch the host file to stop communication with the activation servers. I've found that with several ...
4
votes
3answers
135 views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
4
votes
2answers
1k views

Is an AIA or CRL useful / required at the Root CA if that Root is used to cross certify another PKI?

Suppose I have several independent PKIs that are used Two internal PKIs: One with SHA1 support the other with Suite B algorithms. A partner who I trust and have a policy map with. Since both my ...
4
votes
1answer
136 views

User Groups (Circles) Inside a Web of Trust

Assume I have a universe of U users. Every user has his private key. I want to build user groups by adding a company sub key to his key set. Now users can sign his company sub key with there company ...
4
votes
1answer
2k views

AIA/CRL locations for Offline Root

I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building It's an ...
3
votes
1answer
99 views

Is it a good idea to generate certificate-specific CRLs? What is this technique called?

Suppose I create 3 certificates with the following CRLs Cert1 http://crl.server.com/batch1/root1.crl Cert2 http://crl.server.com/batch2/root2.crl Cert3 ...
3
votes
1answer
51 views

How to handle CRLs correctly in long-term electronic signatures?

What is a recommended way of handling CRLs in long-term electronic signatures (specifically the CAdES-A)? The problem I see is in that CRLs are not protected against modification (they are plain ...
3
votes
2answers
74 views

The best way to change my pgp key

I would like to change my pgp key because I have the same one 2 years ago. But, I want to warn my freinds that the owner of the old key and the owner of the new one is the same person (me). hwat is ...
3
votes
3answers
586 views

Revoke a certificate without index.txt

I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
3
votes
1answer
76 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
3
votes
2answers
74 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
2
votes
2answers
2k views

Ssl certificate rekey or revoke

I want to be sure to understand well the situation where SSL certificate is compromised. If I ask for a rekey, I suppose the old certificate will remain valid. The future communications with the new ...
2
votes
2answers
437 views

distribution mechanisms for CRLs

From the X.509 RFC: DistributionPoint ::= SEQUENCE { distributionPoint [0] DistributionPointName OPTIONAL, reasons [1] ReasonFlags OPTIONAL, cRLIssuer ...
2
votes
1answer
500 views

How does an offline CA revoke certificates?

If an RSA private key of a root CA is stored offline, how does it revoke certificates it signs? From looking at OpenSSL config the default_crl_days option seems to indicate that a CRL must be ...
2
votes
1answer
777 views

What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)

I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks. I understand that clients may not validate the ...
2
votes
1answer
235 views

ISO 27001 failure to comply

Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that ...
2
votes
3answers
192 views

Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?

My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely. Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
2
votes
2answers
634 views

Revoked certificate validation using past times

I'm working on XAdES implementation for Java, as such I require cryptographic implementation to be able to verify certificates in the past. Unfortunately I have problems verifying revoked ...
2
votes
2answers
90 views

Does it make sense that OCSP returns state for the signer CA itself

I have seen an implementation that in signature verification time searches for OCSP responses signed by the CA validating the status of the CA itself, so my question is if somewhere (maybe RFC2560) ...
2
votes
1answer
788 views

What should a CRL file name look like when “new” and “delta” CRLs are generated?

I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated. When I created the ...
2
votes
2answers
361 views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
1
vote
1answer
228 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
1
vote
2answers
87 views

SSL cert minimize downtime key rotation strategy

As you already know, due to the heartbleed bug, we need to perform re-keying on our web servers (>10), before I do that, I want to check if my proposed strategy is a proper way or not a. Generate a ...
1
vote
1answer
31 views

Is long-term validity definitively corrupted upon TSA certificate revocation?

Suppose a document that was signed with a long-term signature (e.g. CAdES-A): D S T1 (D - document, S - signature, T1 - time-stamp created using a time-stamping certificate C1). If C1 appears in the ...
1
vote
1answer
313 views

When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?

When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism? Related information on a different answer Consider using HTTP instead ...
1
vote
0answers
21 views

Specify port for cRLDistributionPoint?

cRLDistributionPoints is OID 2.5.29.31. Here's what one looks like under Gutmann's dumpasn1: SEQUENCE { OBJECT IDENTIFIER cRLDistributionPoints (2 5 29 31) OCTET STRING, encapsulates { ...
1
vote
0answers
49 views

Cetificate Pinning. How do we handle the situation where a website is visited for the first time?

What I essentially mean to ask is, how is the scenario where a user who visits a website for the first time (the certificate for the website is not pinned in the browser) handled ? Additionally how is ...
0
votes
1answer
220 views

Does S/MIME provide means to propagate a certificate's revocation?

Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
0
votes
1answer
48 views

Good reason to continue using fraudulent certificate?

A relative of mine used a favorites link to login to yahoo. The favorite link is https://de.mg40.mail.yahoo.com/neo/launch? However, this link uses a fraudulent certificate. Visiting the Yahoo ...
0
votes
1answer
67 views

Should all Server Certificates from one CA have the same CRL

I am setting up my own PKI, and I came across a question to which I couldn't find an answer. I want to specify CRLDistributionPoints in my server certificates but I am curious whether to use the same ...
0
votes
1answer
29 views

Is a PGP revocation certificate sensitive?

In relation to an openpgp key on a smartcard: Besides revoking the key, is there anything else it can be (ab)used for? Can I just ensure it's reliably stored but not worry about it's confidentiality? ...