New answers tagged

1

Gnupg is open source (yeah!) and hence it can be looked up what happens. When you create a revocation certificate for a key i.e. via `gpg --gen-revoke name" it internally moves through the following functions/key steps main() in gpg.c (the gpg command line tool) is called, then parameters parsed and then gen_revoce( const char *uname) in revoce.c is ...


1

..would be quite slow. Am I missing something in this protocol? You are right that this is slow and these CRLs can be really large. Therefore browsers usually don't use CRLs. Instead they use OCSP to check the status of a specific certificate or yet another mechanism like CRLsets.



Top 50 recent answers are included