Tag Info

New answers tagged

0

Based on this answer from Thomas Pornin: Revocation is on per-certificate basis. What is revoked is the certificate (i.e. the binding between your key and your identity), not the key. Of course, if several CA have issued certificates that bind your key to your name, and your key gets stolen, then you would like all these certificates to be revoked. ...


1

Actually the Base CRL will have the next update time for each issuance. So the client who is verifying the CRL will first validate the signature and then the next update CRL time. In your case, if the client is using the old CRL , it will miss the new CRL entries. but for this scenario, the client needs to verify the server who issuing the base CRL regularly ...


2

Base and delta CRL are linked together through the CRL Number. The "CRL number" is a monotonically increasing integer that, roughly speaking, characterizes the age of the information contained in the CRL. From the point of view of the validator (the "client"), a delta CRL can never be used alone, but only in combination with a base CRL, subject to the ...



Top 50 recent answers are included