4

I know that modern web browsers don't check CRLs for certificates from CAs in the default trust store anymore. I also know that there are some exceptions for certificate validation when it comes to corporation / enterprise PKIs. For example for the lifetime of a certificate, optional certificate features like issuer policy and so on.

Since I came into an argument if OCSP responder are required in an corporate/enterprise PKI, my question is:

Do current Browsers (Edge, Chrome, Firefox, Safari) in 2023 still check CRLs of webserver and SubCA certificates to determine their certificate validity, if no AIA/OCSP distribution points are specified and the certificates are issued by an corporate/entterprise pki RootCA?

This does not ask the question if the certificates are considered valid. (They are) I ask if the CRL distribution points actual affect the certificate validity.

Improve this question

1 Answer 1

Reset to default
4

Chrome/Chromium/Edge can be configured to check OCSP and CRL, but they don't by default. These are options for Webkit based browsers, so the list might be longer than those three.

Firefox checks OCSP, but not CRLs. This can't be configured as far as I'm aware.

Improve this answer
1
  • 1
    Ok, great. From the Mozilla link we can assume that classic CRLs will never be processed. If the PKI operator want to provide certificate revocation, they have to provide an OCSP resolver.
    – Ludwig Behm
    Commented Mar 16, 2023 at 16:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .