Considering some CA certificates are hardcoded into operating systems, I was wondering what happens when one of these hardcoded certificates is revoked (put on a revocation list for example) because of it being compromised?

Does the operating system have a system for updating it in case it is revoked? How? And how can it be updated after it has expired?


As can be seen from Can a RootCA be revoked? there is no mechanism inside a PKI that a root CA gets removed. This means a mechanism outside the PKI is needed. This consists usually of an update of the trust store through update of the browser or the system which removes this certificate from the trust store or mark it as untrusted.

Such events happened in the past for example with DigiNotar. This case was handled by updates to the Firefox and Chrome browsers, updates of Microsoft Windows and of iOS and Mac OS X.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.