4

In other words, if Certificate Authority goes down, does this mean that all HTTPS sites that purchased SSL certs from this CA will also become unavailable?

7

Kinda. The browser verifies the certificate was issued by the CA without contacting the CA. But the certificate might have been revoked since then, for example because the site's private key leaked. To verify the certificate has not been revoked, the browser needs to contact the CA's CRL or OCSP site. If those are down, there is no way to know whether the certificate is revoked. In practice, because keeping those sites up is expensive, they are often down and modern browsers either don't check or try to check but don't fail the connection if the CA is unreachable. So a certificate will keep working if its CA is down. If the CA goes down permanently, you can't revoke the certificate, which is a problem.

To solve the scalability issues with CRL and OCSP, OCSP stapling was invented. Your site itself contacts the CA once a day to get a signed note that says "at this time, the certificate has not been revoked" and passes this signed note to the browser. This leaves a window of a day during which the certificate might have been revoked and your browser won't suspect a thing, which is better than what we have now.

3

No. The CA's root certificate is usually installed in the client's certificate store. When the client makes a handshake request, they receive the cert from the site (which I'll refer to as example.com). The cert for example.com will include a root cert and possibly an intermediate cert, and the client (in this case, the browser) will check its cert store to see if it contains the root cert.

Basically, if the CA's website goes down, it has no effect on sites that purchased certs from the CA.

  • 4
    That is incorrect. It may have some effects. See the other answer about CRL and OCSP – Tom Apr 2 '16 at 16:31
  • 2
    @Tom I didn't know about that! Thanks for pointing it out. – Philip Rowlands Apr 2 '16 at 17:22
  • @PhilipRowlands Well, OK. But +1 from me is still yours ) – Oleg Apr 2 '16 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.