0

I am an Open Banking enthusiast and I'm studying the Berlin Group's XS2A framework these days. There, it has an error code called CERTIFICATE_BLOCKED. As the description of it, it states,

"Signature/corporate seal certificate has been blocked by the ASPSP or the related NCA."

What I need to understand is what is the difference between certificate "blocking" and revoking? I understand the concept of why certificate authorities revoke certificates. We also can validate the certificate revocation statuses using OCSP and CRL endpoints online.

Following are what I need to understand,

  1. What is the difference between certificate "blocking" and "revoking"?
  2. Is blocking temporary? Can a blocked certificate be unblocked by a CA or an ASPSP (ASPSP is the word for a bank in Open Banking context)?
  3. Can anyone block a certificate (ASPSP/NCA)?
  4. Is there a way to check the certificate blocking status like OCSP and CRL endpoints?

PS: I've also looked up RFC5280, hoping there might be an explanation. I couldn't find anything about certificate blocking other than from the XS2A Berlin Open Banking specification.

Improve this question

2 Answers 2

Reset to default
1

There is no specification in RFC5280 for blocking a certificate, but suspension and hold of certificate can be used to revoke the certificate temporarily:

  1. As per RFC5280 certificate can be put on hold with CRL reason as "certificateHold" :

    If the certificate is valid and was listed on the referenced base CRL or any subsequent CRL with reason code certificateHold, and the reason code certificateHold is included in the scope of the CRL, list the certificate with the reason code removeFromCRL.

    Which could be used by CA to temporary revoke a certificate. CA can unrevoke the certificate if the reason code is certificateHold

  2. Certificate suspension is also used to temporarily suspend the certificate, but no longer than 60 days. If the suspension period goes beyond this time, the certificate will be withdrawn definitely by CA.

Blocking of the certificate could be related to any one of the stated reasons. However, there could be other reasons as well as per specification of ASPSP.

Can anyone block a certificate (ASPSP/NCA)?

Open Banking has an engagement group of QTSPs (qualified to provide trusted certificates). The list of trusted CA can be found over here link

So, I think these list of trusted CA can revoke a certificate.

Is there a way to check the certificate blocking status like OCSP and CRL endpoints?

Refer to the list of trusted CA for OCSP and CRL.

Improve this answer
4
  • I found that the certificates can be suspended by a CA. And also according to datatracker.ietf.org/doc/html/rfc6960#section-2.2 and your answer, does it mean we can identify a temporarily revoked (or suspended, or held) certificate by inspecting the reason code "certificateHold"? Does the reason code always present if the certificate is suspended?
    – Agent47
    Aug 30, 2021 at 10:56
  • Yes, it is possible to identify whether certificate is suspended or held. You need to check the CRL list for the same.
    – saurabh
    Aug 30, 2021 at 10:58
  • According to the rfc6960, even if the certificate is suspended, the revocation status will be the same as "revoked". So if the reason code "certificateHold" is present with the status "revoked", we can assume that the certificate is revoked temporarily (or suspended). Right?
    – Agent47
    Aug 30, 2021 at 11:22
  • 1
    If the certificate is on hold with reason code "certificateHold" then either certificate will be revoked permanently with another reason code or unrevoked. So, it could be assumed that until the reason code is "certificateHold", the certificate is temporarily revoked.
    – saurabh
    Aug 30, 2021 at 11:47
1

  1. Certificates can be revoked or suspended. I believe blocked refers to suspended in your case. Suspension is the term more commonly used when it comes to PKI management which is why you cannot find many references.

  2. Suspension is temporary, it can be undone. Typically used when you lose your Government electronic ID card (containing qualified digital certificates) only to find it later. Revocation is permanent.

  3. I do not know what functions the "ASPSP/NCA" carry out, but if they are a root or intermediate CA, they can suspend/unsuspend, and revoke certificates.

  4. Certificates having been suspended are indeed published on the CRLs (as well as those which have been revoked).

Improve this answer
1
  • In datatracker.ietf.org/doc/html/rfc6960#section-2.2, it is mentioned that "The 'revoked' state indicates that the certificate has been revoked, either temporarily (the revocation reason is certificateHold) or permanently." Does this mean we can identify temporarily revoked (suspended) certificates by observing the certificateHold extension? Does every revoked certificate contain this "certificateHold" extension? But still the revocation status will be "Revoked", making the "certificateHold" extension the only thing we can identify whether the certificate is suspended or not.
    – Agent47
    Aug 30, 2021 at 10:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .