4

I don't want the certificate revocation lists. I want actual full on revoked certificates for test purposes.

For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and got rogue certs for them from Verisign. I think it'd be interesting to have both of these certs.

Like one thing I'm curious about: was the CRLDistribituionPoint extension present in them? I'm curious about other things too but if someone has them that'd be great. Thanks!

  • 3
    What are you trying to test? You can probably set up your own CA and test the scenarios yourself. – goodguys_activate Nov 10 '12 at 17:09
2

You could just use a MD5 rogue certificate (directly to the demo page). Also see the research paper.

I also found a research on the rogue certificates from March 2011.

Maybe searching the Internet for those black-listed rogue certificates' serial number will help:

00:b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0 login.live.com
00:e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47 login.skype.com
00:39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29 login.yahoo.com
00:3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71 login.yahoo.com
00:d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3 login.yahoo.com
00:04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e mail.google.com
00:f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06 www.google.com
00:92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43 addons.mozilla.org

These serial numbers are from the Microsoft certificate store after applying the relevant updates.

I did some searching, but all i found was the link 4 I already mentioned above.

1

I was able to obtain revoked certificates for testing by opening the Certificates Snapin in Microsoft Management Console and looking in the Untrusted Certificates store. There you will see a large number of revoked certificates. Right click and export to get them into a file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.