New answers tagged certificate-revocation
Thanks to Milen I saw that I have had a version update of google chrome (from 38.0.2125.111 to 39.0.2171.71) just while downloading firefox. The Chrome's UI did the update without any notification, and this fooled me. Quite strange, from Google. I mean: would you like to know that an upgrade will change the security policy in the next execution of the ...
Check if you're running Chrome 39, there are major changes to the way some certificates are treated - e.g. Chrome 39 starts to penalize sites with long-lived SHA1 certificates This release warns about SHA1 certificates that expire in 2017. Versions 40 and 41 will increase the scope of the warnings to include certificates that expire in 2016. More info can ...
About the replay attack, the CRL is time stamped with the date of generation and a date for the next update. The nextUpdate date is mandatory in the PKIX profile. If a certificate is revoked, the old CRL can be replayed before nextUpdate if an unsecure channel is used.
There is no such thing as a non-signed CRL; the signature field is mandatory, and any system that uses the CRL will verify the signature. In pure X.509, a CRL will be deemed "acceptable" as a source of information about the revocation status of a given certificate E if it is signed by an "allowed revocation issuer": the CRL's signature must match the public ...
Top 50 recent answers are included