New answers tagged

1

The website operator is responsible for notifying the CA to revoke the certificate, and would usually reissue a new Certificate at the same time. The CA is then responsible for publishing this information through CRL and/or OCSP. The client application is responsible in fetching the CRL/OCSP status of a Certificate from the CA. In some rare cases, the CA ...


25

The answer by user2320464 is good, but I'd like to expand more. Summary: The certificate holder generally does not manage their own revocation information, because the whole point of revocation is to announce that holder of this certificate is not trustworthy. The rightful owner of the cert needs to be able to declare the cert Revoked, but in a way that ...


5

Typically certificates are revoked by the person being issued the certificate. So if you were to purchase an SSL certificate and later found the private key was compromised, then you would revoke the certificate. This action would be recorded on the "Issuing CA" where the serial number of the newly revoked certificate would appear in the Certificate ...


2

It is the responsibility of the person who bought the certificates to ensure the security of the cert. It is the responsibility of the CA to revoke any certificates that were sighted breaching the terms of service. A certificate is a lot like a driver's license. If someone steals it, you have to report it.


2

Since there is no way to cryptographically invalidate a certificate, a system must be used to publicly announce the revocation of a certificate. The Online Certificate Status Protocol (OCSP) is the current way of doing this. Browsers can check an OCSP provider to confirm that a certificate is not revoked before connecting to a website.



Top 50 recent answers are included