Tag Info

New answers tagged


From the iOS 7 Deployment Technical Reference document (opens a PDF): Certificate validation The first time a user opens an app, the distribution certificate is validated by contacting Apple’s OCSP server. Unless the certificate has been revoked, the app is allowed to run. Inability to contact or get a response from the OCSP server isn’t ...


The general situation looks like this: A signature relies on some certificates, that assert the ownership of public keys. Certificates are primarily designed to be validated now (e.g. the certificate's date of validities are compared with the current date). These objects tend to degrade over time. CRL expire (usually rather fast). Certificates expire; when ...


Regarding CRLs: CRLs are issued regularly. They don't need -- nor should they have -- long durations between updates. They are regularly reissued. (I just checked Facebooks certificate and they use http://crl3.digicert.com/ca3-g29.crl -- This CRL lists 7 days as the maximum time until the next update.) So you can just sign them with the signature of your ...


It would not be advised, especially not on any public online resources. If the revocation keys gets in the wrong hands, someone can revoke your keys without your consent or knowledge.


CA or a Sub CA Anything apart from a Root CA may in principle be revoked using the regular ways. (CRL and/or OCSP) [...] they may want to suspend the certificate till the time, they confirm that this is true. Technically you should be able to do this by using reason code "certificateHold (6)" on your CRL. This is a temporary revocation and ...


If you think a downstream (subordinate) CA is compromised, you have a duty in your position of trust to revoke the suspected compromised CA to prevent them from eroding trust in you, the parent CA.

Top 50 recent answers are included