New answers tagged


That intermediate CA's certificate should specify how revocation can be checked. If the device performs revocation checks then it is going to access the CRL, use OCSP, or something similar. That response should specify that the intermediate CA certificate was revoked. Assuming the device processes this response appropriately it would no longer trust the ...


The certificate is digitally signed by a 3rd party, e.g. a CA (certificate authority). This signature can be verified using the public key of the CA. If the attacker modifies the public key, the signature won't match any longer. If the attacker also finds a way to modify the public key of the CA, then you lost I'd say.


HTTPS (or any TLS clients really) need to know the certificate revokation status before being able to trust that TLS connection. If the HTTPS connection used to fetch the CRL itself can't be trusted, then what is the point? Not to mention, your original HTTPS connection triggers a CRL lookup, which in turn triggers another HTTPS connection for the CRL server,...

Top 50 recent answers are included