3

In a recent online course, an instructor stated:

Once you've created a certificate, eventually you are going to have to revoke it, and even if that's just to renew it, really, I mean if you have created a certificate and it's gonna last, say, a year, or maybe three years, ultimately that certificate will have to be renewed, and before you can renew it, you have to revoke it.

Is that strictly accurately? I always thought that certificates which expired naturally (and weren't replaced in the middle of their term) were rejected by clients because they were expired -- not because they were marked as revoked by the CA. Can someone please clarify?

Improve this question
1
  • 1
    Having an expire date on a certificate is especially important to be able to prune down CRLs, so you normally should not expect any expired certs to be found on CRLs. And it is rather uncommon to revoke a cert just to renew it (especially if you renew it at the end of its lifetime)
    – eckes
    Commented Oct 26, 2017 at 5:48

1 Answer 1

Reset to default
4

Note that the following is only valid for the usage of certificates in the context of TLS. It can differ in other use cases for certificates, like with digital signatures on documents, mails, signed programs etc.

You don't have to revoke a certificate even if you renew it. You need to revoke a certificate only if it or what it represents got somehow compromised, like if the private key might be known to some third party or if the domain has changed the owner and thus all previously issued certificates to the old owner should be no longer valid.

Otherwise a certificate has an expiration time where it will be naturally stop working. Proper clients will check the expiration and will not accept certificates which are expired. No additional check for revocation is done for expired certificates since they are not valid anymore anyway and thus no revocation need to be done.

Improve this answer
3
  • 1
    No additional check for revocation is done for expired certificates since they are not valid anymore anyway and thus no revocation need to be done. -- it is not correct when talking about digital signatures. In timestamped signatures (authenticode), expired certificates are checked for revocation and even by using (possibly) expired CRL.
    – Crypt32
    Commented Oct 25, 2017 at 7:41
  • @Crypt32: You are right, I implicitly assumed that the context of this question is TLS. I've changed my answer accordingly.
    – Steffen Ullrich
    Commented Oct 25, 2017 at 7:58
  • @SteffenUllrich You are correct. The context of this question is TLS. I have added an additional tag to the post to further clarify.
    – Mike B
    Commented Oct 25, 2017 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .