Tag Info

New answers tagged

4

There is no global directory of all issued certificates (X.509 was designed to support the Directory, but it never existed in practice). You will have to contact "all CA" and ask them nicely. Basically, this would mean going to their site, and using the "I lost my password" feature so as to regain control of your account, if it exists. Details vary depending ...


3

Partly solving the underlying problem, you may use Public-Key-Pins header to restrict which certificates are valid for your domain (so a stolen certificate could only be used by a man-in-the-middle would on the first connection to your site). You can also use Public-Key-Pins-Report-Only to get notifications for failed Pin validation. Both headers are ...


4

You are using the expression "zero-knowledge proof" but it does not mean what you believe it to mean. A ZKP proof is a kind of cryptographic protocol by which a Prover demonstrates to a Verifier a given property on a secret value. The proof is "zero-knowledge" if it does not divulge any extra information to the verifier. For instance, suppose that there is ...


2

Certificates are for authentication, not for authorization. Authentication is (here) about the OpenVPN server making sure that the alleged client is who they claim to be. This is the point of certificates: the client shows his certificate, which contains his public key and identity; the server validates the certificate (with regards to its trusted CA) to ...


1

A plan of action for this is to have regular monitoring and auditing performed on all requests. A little about how SSL CAs work (source: Fox-IT Post Breach of DigiNotar) Current browsers perform an OCSP check as soon as the browser connects to an SSL protected website through the https-protocol3. The serial number of the certificate presented by the ...


1

A stolen CA private key is a bad situation indeed. Response depends on the extent of the breach, and the context. First, it may be so that the CA private key was not exactly stolen, but merely used improperly. For instance, in the case of the Comodo event, the compromise was on Registration Authority accounts. The RA is the component who tells to the CA ...


6

The question is... a bit complex. The critical issues are existence and availability of intermediate CA certificates. Consider the following points: Root CA are not "revoked". Revocation is a mechanism by which the issuer for a given certificate specifies, directly or indirectly, that one of its issued certificates is not to be trusted and must not be used ...


-1

Normally if a CA is renewed, the new CA uses the same public/private key pair as the old. If not, all certificates issued by the CA will no longer be valid. Creating a CA with the same subject and serial number as the old CA but with a different public/private key is more or less a completely new CA from a PKIs perspective. So if the XP client only has the ...


0

This may see like a cop-out answer but it is not if you stay with me. PKI is just as much about the paperwork (policies and procedures) than it is about technical constraints. So if you have defined in your Certificate Practice Statement that your organization can and will suspend CA certificates as part of normal operations, then yes I do believe that the ...


1

I will caution that I haven't tested this behavior, so while I believe my answers are based on sound logic it may not be the same logic that Microsoft chose to implement. When a client is determining whether to trust a certificate it will work its way up the CA tree (from initial certificate to root CA) verifying signatures of the certs. If a CA's key pair ...



Top 50 recent answers are included