Tag Info

New answers tagged

4

The question is... a bit complex. The critical issues are existence and availability of intermediate CA certificates. Consider the following points: Root CA are not "revoked". Revocation is a mechanism by which the issuer for a given certificate specifies, directly or indirectly, that one of its issued certificates is not to be trusted and must not be used ...


-1

Normally if a CA is renewed, the new CA uses the same public/private key pair as the old. If not, all certificates issued by the CA will no longer be valid. Creating a CA with the same subject and serial number as the old CA but with a different public/private key is more or less a completely new CA from a PKIs perspective. So if the XP client only has the ...


0

This may see like a cop-out answer but it is not if you stay with me. PKI is just as much about the paperwork (policies and procedures) than it is about technical constraints. So if you have defined in your Certificate Practice Statement that your organization can and will suspend CA certificates as part of normal operations, then yes I do believe that the ...


1

I will caution that I haven't tested this behavior, so while I believe my answers are based on sound logic it may not be the same logic that Microsoft chose to implement. When a client is determining whether to trust a certificate it will work its way up the CA tree (from initial certificate to root CA) verifying signatures of the certs. If a CA's key pair ...



Top 50 recent answers are included