Tag Info

Hot answers tagged

3

You should see the certificate infrastructure (that is to say the PKI, Public Key Infrastructur) as a web of trust. When you are communicating with multiple persons, which wants to mutually authenticated themselves (and their websites), you first choose a common trusted person. This third person becomes a "Trusted Third Party" and will be called the ...


3

By trusting the Root CA you're trusting their judgement in who they sign. As long as the intermediate CA is valid, not revoked, and you're trusting the Root CA... the chain will always be verified. Other applications (such as NSS) can add additional checks and functionality to provide this, but unless the application provides it it's not really part of the ...


2

"End Entity" is defined in X.509 (well,RFC 5280) as: end entity: user of PKI certificates and/or end user system that is the subject of a certificate; but the expression really makes sense in the context of path validation: an "EE" certificate is called that way because when it appears in a certificate path, it is necessarily at the end of ...


2

Base and delta CRL are linked together through the CRL Number. The "CRL number" is a monotonically increasing integer that, roughly speaking, characterizes the age of the information contained in the CRL. From the point of view of the validator (the "client"), a delta CRL can never be used alone, but only in combination with a base CRL, subject to the ...


1

Actually the Base CRL will have the next update time for each issuance. So the client who is verifying the CRL will first validate the signature and then the next update CRL time. In your case, if the client is using the old CRL , it will miss the new CRL entries. but for this scenario, the client needs to verify the server who issuing the base CRL regularly ...


1

I don't think you could do this with the usual applications.. If you have your own application using the OpenSSL library you could handle this condition inside the certificate verify_callback. This callback is called on verification for each certificate in the trust chain and you can distrust the certificate by just returning 0. Note that this will cause ...



Only top voted, non community-wiki answers of a minimum length are eligible