Skip to main content
Information Security

Return to Question

deleted 4 characters in body
Source Link
Mumbar
Mumbar
  • 5
  • 3

My situation looks like this:

I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revocatedrevoked. But what if certificate ends (notAfter from Validity of certificate) before next update of CRL?

Schematically:

  1. CRL publishing
  2. Signature creation
  3. Certificate expiration (notAfter time of certificate)
  4. CRL publishing

Suppose certificate was revocatedrevoked between (1) and (4). I think it won´t be in CRL (4) because it is not valid any more. But in this type of scenario I can not validate signature, or can I?

My situation looks like this:

I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revocated. But what if certificate ends (notAfter from Validity of certificate) before next update of CRL?

Schematically:

  1. CRL publishing
  2. Signature creation
  3. Certificate expiration (notAfter time of certificate)
  4. CRL publishing

Suppose certificate was revocated between (1) and (4). I think it won´t be in CRL (4) because it is not valid any more. But in this type of scenario I can not validate signature, or can I?

My situation looks like this:

I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revoked. But what if certificate ends (notAfter from Validity of certificate) before next update of CRL?

Schematically:

  1. CRL publishing
  2. Signature creation
  3. Certificate expiration (notAfter time of certificate)
  4. CRL publishing

Suppose certificate was revoked between (1) and (4). I think it won´t be in CRL (4) because it is not valid any more. But in this type of scenario I can not validate signature, or can I?

added 25 characters in body
Source Link
Mumbar
Mumbar
  • 5
  • 3

My situation looks like this:

I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revocated. But what if certificate ends (notAfter from Validity of certificate) before next update of CRL?

Schematically:

  1. CRL publishing
  2. Signature creation
  3. notAfterCertificate expiration (notAfter time of certificate)
  4. CRL publishing

Suppose certificate was revocated between (1) and (4). I think it won´t be in CRL (4) because it is not valid any more. But in this type of scenario I can not validate signature, or can I?

My situation looks like this:

I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revocated. But what if certificate ends (notAfter from Validity of certificate) before next update of CRL?

Schematically:

  1. CRL publishing
  2. Signature creation
  3. notAfter time of certificate
  4. CRL publishing

Suppose certificate was revocated between (1) and (4). I think it won´t be in CRL (4) because it is not valid any more. But in this type of scenario I can not validate signature, or can I?

My situation looks like this:

I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revocated. But what if certificate ends (notAfter from Validity of certificate) before next update of CRL?

Schematically:

  1. CRL publishing
  2. Signature creation
  3. Certificate expiration (notAfter time of certificate)
  4. CRL publishing

Suppose certificate was revocated between (1) and (4). I think it won´t be in CRL (4) because it is not valid any more. But in this type of scenario I can not validate signature, or can I?

Source Link
Mumbar
Mumbar
  • 5
  • 3

Check signature when next CRL will be published after end of validity of certificate

My situation looks like this:

I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revocated. But what if certificate ends (notAfter from Validity of certificate) before next update of CRL?

Schematically:

  1. CRL publishing
  2. Signature creation
  3. notAfter time of certificate
  4. CRL publishing

Suppose certificate was revocated between (1) and (4). I think it won´t be in CRL (4) because it is not valid any more. But in this type of scenario I can not validate signature, or can I?