Tag Info

New answers tagged

1

Actually the Base CRL will have the next update time for each issuance. So the client who is verifying the CRL will first validate the signature and then the next update CRL time. In your case, if the client is using the old CRL , it will miss the new CRL entries. but for this scenario, the client needs to verify the server who issuing the base CRL regularly ...


2

Base and delta CRL are linked together through the CRL Number. The "CRL number" is a monotonically increasing integer that, roughly speaking, characterizes the age of the information contained in the CRL. From the point of view of the validator (the "client"), a delta CRL can never be used alone, but only in combination with a base CRL, subject to the ...


0

You are not the first to think of this. See the last sentence in PKIX rfc5280 3.3 X.509 defines one method of certificate revocation. This method involves each CA periodically issuing a signed data structure called a certificate revocation list (CRL). A CRL is a time-stamped list ... A new CRL is issued on a regular periodic basis ...


0

Yes, if it is set to be revoked the next week when a new CRL is set to be released, I would wait. Given that you said and put quotations around "probably" in reference to being valid for the remaining week, this would be a red flag to me and again, I would wait the week until next CRL. If access is not absolutely necessary and required for business ...



Top 50 recent answers are included