Tag Info

New answers tagged

0

You are correct in that contacts may receive a "certificate expired", if they attempt to encrypt an email to you first and attempt to use the expired, cached certificate (this doesn't apply to signed-only emails). Their email client may allow them to proceed if they persist. Additionally, there's a small chance that the certificate chain may have changed ...


2

Theory is that everything works automatically. Practice sometimes differs. I suppose that you are talking about S/MIME and X.509 certificates. With S/MIME, when you send an email: The email is encrypted with the public key of the recipient, so you have to know the current recipient's certificate. The email is signed with your private key and the signature ...


1

It is not uncommon for revocation checking to fail due to the CA revocation service not being available - or it being late in publishing a CRL. So you are probably okay. A revocation check can be either to to CRL file which is published periodically by the CA (e.g. every 8 hours) which has a validity period or using an Online Certificate Status Protocol ...


13

Revocation is the only method by which a certificate authority may propagate the information that a private key has been compromised. It is, in fact, a damage containment system: in the unfortunate event of a private key being stolen, the revocation system will make sure that nobody trusts the corresponding certificate more than one week or so after the ...


0

If a Commercial CA believe they are compromised they will revoke the sub-CAs that they believe are affected. This does not mean that all software that trusts that CA will automatically distrust the compromised CA. Browsers for example should check a certificate revocation list (CRL) before trusting a certificate chain. However, these checks are ...



Top 50 recent answers are included