The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
2answers
50 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
2
votes
1answer
295 views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
0
votes
1answer
58 views

From where I can get a list of trusted certificates fo HTTPS?

I am using OpenBSD with a browser named Xombrero that doesn't have SSL certs by default. Should I get the certs from the /etc/ssl/certs.pem file? (ex.: I am not trusting OCSP and don't trust that my ...
3
votes
1answer
76 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
2
votes
1answer
410 views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
0
votes
1answer
898 views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
11
votes
1answer
2k views

How does OCSP stapling work?

I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...