Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or would the respective CA have to set up a CRL or OSCP server?


In X.509, all revocation goes through objects signed by certificate issuers. The decision to revoke or not revoke is not in the hands of the certificate owner, but of its issuing CA. The CA makes its decision known by including or not including the target certificate serial number in the CRL it produces (ditto for OCSP responses, which are just CRL with a scope reduced to a single certificate).

S/MIME relies on CMS (formerly known as PKCS#7) for the format of signed and/or encrypted emails. CMS can embed arbitrary "helper objects", including CRL and OCSP responses, if whoever assembles the message thinks that these CRL or OCSP responses might be helpful to recipients for the certificate validations they will perform. This can be used in case the CA does not have a reliable way to push its CRL in a place where the recipient will be able to grab them (a relatively rare scenario: people who receive emails often have an Internet access). Nevertheless, these CRL or OCSP response must necessarily come from the CA (or an entity to which the power was delegated, e.g. an OCSP responder).

In the X.509 model, everybody is assumed to be able to obtain fresh CRL or OCSP responses (and they should reject certificates if they cannot). In S/MIME, the sender's certificate is included in every email he sends, and recipients are supposed to automatically record the received certificates; when they respond, their tools should pick up the newest known certificate (after validation with revocation check, of course).

| improve this answer | |
  • So if I ran my own CA, I could theoretically attach a CRL containing one revocation, although I'd most likely have to do this in a command line via openssl smime instead of a usual mail client (e.g. Thunderbird). And how mail clients react when they receive a CRL/OSCP response is probably not well defined, correct? – Tobias Kienzler Feb 8 '13 at 16:24
  • (Ok, according to this answer an OSCP response would be the correct choice) – Tobias Kienzler Feb 8 '13 at 16:28
  • 1
    What clients do with the helper objects is up to them. I expect that most clients will just ignore them. – Tom Leek Feb 8 '13 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.