Tag Info

New answers tagged

5

From RFC 5280 3.3 Revocation An entry MUST NOT be removed from the CRL until it appears on one regularly scheduled CRL issued beyond the revoked certificate's validity period. If you have a lot of changes (people leaving etc.) it's best to not make the certificate validity too long otherwise the CRL can grow large (some CRLs are > 30MB which ...


2

Expiration date is "baked" into certificate itself, so even if time on client is incorrect this wouldn't cause server to mistakenly accept the certificate. Server clock, on the contrary, have to be correct. Now, whether or not it is safe to remove expired certificates from the CRL depends on how server verifies certificates and, in particular, whether it ...


5

There is no global directory of all issued certificates (X.509 was designed to support the Directory, but it never existed in practice). You will have to contact "all CA" and ask them nicely. Basically, this would mean going to their site, and using the "I lost my password" feature so as to regain control of your account, if it exists. Details vary depending ...


4

Partly solving the underlying problem, you may use Public-Key-Pins header to restrict which certificates are valid for your domain (so a stolen certificate could only be used by a man-in-the-middle would on the first connection to your site). You can also use Public-Key-Pins-Report-Only to get notifications for failed Pin validation. Both headers are ...



Top 50 recent answers are included