If a certificate is revoked, can it be re-instated, or is the only option to generate a new one?
1
-
1If it could be reinstalled, then that's not really revoking anymore. The whole point of revoking a certificate is to prevent it from being abused should it fall into the wrong hands.– Nonny MooseCommented Jul 29, 2018 at 16:55
Add a comment
|
4 Answers
The only option to unrevoke is when certificate is revoked with certificateHold reason (§5.3.1 in RFC5280). In all other cases the certificate (and the key) must be re-created.
-
Interesting. Do you know of any CAs that will reject a CSR if the key was previously revoked? Commented Jul 29, 2018 at 19:46
-
It is up to CA. Since they record all issued and revoked certificates, they may check if public key in CSR was signed in the past and check if it was revoked. However, I'm not aware of any public CA that would do that. Microsoft ADCS doesn't either.– Crypt32Commented Jul 29, 2018 at 19:49
-
1@StackzOfZtuff Entrust will reject a CSR if that public key appears in a cert that was revoked for
RevocationReason:KeyCompromise. I can't speak to any other CAs. Commented Jul 29, 2018 at 21:27 -
1I would think the key should not be rejected for issuing new certificates unless the reason was key compromise, and perhaps not even then. For instance if parties A and B had a falling-out, and both had sites served from a server than A controls with the same private key, from B's perspective the cert for their site is compromised since A controls the key. But from A's perspective the key is perfectly valid for future use. Commented Jul 29, 2018 at 21:49
TL;DR: It's not permitted; it's not technically impossible.
Assuming you're not talking about a certificate that's been held, it would be against the rules for a certificate, once revoked, to be unrevoked.
If you ask a CA to unrevoke a revoked certificate, they should refuse, and they'll probably tell you it's impossible.
However, if you websearch, you may find stories of CA's unrevoking certificates.
They shouldn't, but it (apparently) does happen.
A CA is, ultimately, a database containing a lot of certificates, and metadata about the status of each one, including whether or not it has been revoked.
At regular or irregular intervals, the CA parses that database and produces a CRL - a list of revoked certificates.
If your certificate is on that list, it's revoked. (Not that clients always check the list, but that's a different issue.)
If the database gets changed to remove the record of the certificate being revoked, then the next time the list of revoked certificates is produced, the certificate won't be one it. In effect, the certificate will have been unrevoked.
This should NEVER happen. But it's not technically impossible.
See, for example, https://hackernoon.com/godaddy-revoked-and-then-un-revoked-a-certificate-without-request-11f86074bbf8
You create a new one. Usually is easier to issue a new certificate than to unrevoke a revoked one.
answered Jul 29, 2018 at 16:26
Revoking a certificate only affects metadata about that certificate, but doesn't change anything about the certificate at all. If a client doesn't perform revocation checks (such as using a CRL or OCSP), a revoked certificate may still show as trusted.
Revocation works, in the case of most public CAs, because the CA also provides status information for the certificate, and is also where it would be revoked from, so even though that certificate hasn't changed, any X.509 client worth any merit will also check the status of that cert and see that it has been revoked and refuse to trust it.
