New answers tagged

5

It would be a huge operational cost in environments that don't have automated certificate management in place, which, in reality is the vast majority of the operational environments in the world today. In fact, in most environment little to nothing is automated. We've just started seeing people dip their toes in those waters in the past few years, and most ...


2

Both versions of GnuPG are compatible in the output they produce: they both implement RFC 4880, OpenPGP. They're even compatible in the keyring and trust database formats they're using. GnuPG 2.1 supports some additional ciphers and has changes to the keyrings which might prevent using both older versions of GnuPG and GnuPG 2.1 (or in future: newer) at the ...


2

In X509 the fields making a certificate unique is the combination of issuer and serial number. Only the serial number is not guaranteed to be unique since two CAs may use the same serial. This is the reason both are typically needed for revocation. In practice, if you only have one CA, the serial will be enough of course. But it's not generic. There should ...


2

I have never heard the term "retire" applied to certificates. Maybe it has a specific meaning within the context of your certificate management tool? A "revoked" certificate should be considered compromised and no longer trusted. My guess is that a "retired" certificate is no longer being managed by the CA, but there's no evidence of compromise, so the ...


2

I would think this might have to do with what flag is used to mark the cert when it is added to the revocation list. A cert added with reason 4(superseded) or reason 5(cessationOfOperation) are not being revoked because of some compromise or inherent flaw so could be considered to be "retired". There have been several types of certs(sha1 and MD5) that are ...


4

Can I revoke the signing subkey using the public key or do I need a copy of a private key as well? No, you always need the private primary key for all key management operations (subkeys, user IDs, ... are all bound by signatures of the private primary key). Consider it was possible to do this using the public primary key, everybody would be able ...



Top 50 recent answers are included