Tag Info

New answers tagged

0

The only solution I was able to find is to use either Firefox or Internet Explorer, and enable hard-fail. For Firefox: Go to Options -> Advanced -> Certificates-> Validation Check the box for "When an OCSP server connection fails, treat the certificate as invalid" For Internet Explorer: Can only be enabled in registry using ...


0

If the browsers would do proper OCSP checking, e.g. connect only to sites where they got a proper OCSP response (e.g. a signed yes or no, not a try later) it would be secure enough. But browsers don't, e.g. they mostly accept try later responses, except for extended validation certificates. If servers would all support OCSP stapling there would be not ...


5

I find the question useful, because it is actually hard to find out if a certificate got revoked the right way. If you know who issued the original certificate you can download the CRLs (which contains only the serial numbers and the date of revocation, not the revoked certificate itself). If not you are out of luck. If you know the serial number of the ...


-1

Whilst using the CRLSet feature in Chrome is supposed to offer better performance, how does performance replace the security of users if there is no certainty of actual trust? Point in case was recently the CloudFlare challenge website which revoked it's certificate. I decided to test my main two browsers to make sure I still wasn't being taken to the ...


1

Let's assume, for an instant, that you really need to "re-key your Web servers" because of the heartbleed bug (if there is such a need, then you quite logically also need to do it for every other similar vulnerability which shows up, hence several times per year, and you must also do it for vulnerabilities which will show up, so, by that reasoning, your ...


1

You assume incorrectly: a cert does not have to be revoked when re-issued. It is typically a different process altogether. This means that you should add a last step to your plan: revoke the old certificate once you are done with installing the new one. Clients will not cache your certificate. In fact, they cannot keep a cached copy since it is your server ...


0

Upon SSL establishment to the remote server, the certificate chain is retrieved to ensure the trust of the host, if any certificate in the chain is revoked, the chain will be broken and you will recieve a certificate error(untrusted site) upon entering. This is why we use external root CA's like godaddy and such, to confirm the identity of the remote ...


2

When a certificate is revoked, the CRL contains the revocation date which tells at which date the certificate became "invalid". Indirectly, it specifies that the certificate was fine up to that date. For instance, if a private key is compromised after a burglary, the security camera recordings will be used to determine at which hour the key was stolen, and ...


4

A CRL is a signed object, just like a certificate. This is why they need not be covered by the actual document signature. However, for long-term archival, they need to be timestamped. The theoretical background is the following: At a given time T, you may validate certificates and verify signatures by using just-downloaded CRL, which give guarantee about ...


1

The certificate is not necessarily fraudulent (though it does expire on the 28th of March) as much as it is that the name being used to access the resource doesn't match what is on the certificate. It's common for companies to have aliases or CNAMES for services/hosts. The problem is that unless you generate a UCG or SANS cert to handle all the names then ...



Top 50 recent answers are included