2

My understanding is that CRL is a list from a CA that says what certificates not to trust.

Browsers will regularly download these lists from their trusted CAs and check the certificate of requested sites against these lists, alerting the user if the certificate has been revoked.

It seems to me that the process of downloading the (probably) millions of revoked certificates from CAs and searching that list every time the user connects to a site would be quite slow. Am I missing something in this protocol?

Improve this question
  • To clarify, revoked certs which have expired are removed from the CRL list, so the list is not ever growing but remains at a relatively constant size (events like heartbleed are an exception). This does not create a security issue because expired certs are supposed to be untrusted anyway. – limbenjamin Jan 15 '16 at 7:19
1

..would be quite slow. Am I missing something in this protocol?

You are right that this is slow and these CRLs can be really large. Therefore browsers usually don't use CRLs. Instead they use OCSP to check the status of a specific certificate or yet another mechanism like CRLsets.

Improve this answer
  • "OCSP-based revocation is not an effective technique to mitigate against the compromise of an HTTPS server's private key" ... what's the point then? do people just accept this and use it primarily for other types of revocation like the CA going out of business? – jtmarmon Jan 15 '16 at 6:39
  • @jtmarmon: I don't share this opinion in Wikipedia. An attacker owning the private key is not necessarily in the path of the OCSP request, since this is done to a different server (at the CA and not at the owned web server). But if this is the case than the attacker could also block access to the CRL too which makes CRL no better than OCSP in this case. See also the rest of the paragraph in Wikipedia where this statement is somewhat retracted. – Steffen Ullrich Jan 15 '16 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.