1

My understanding is that a CSR contains the public key from the client, and the response is a signed version of that CSR, with certain attributes (EKU, expiration) and other attributes the CA decides to arbitrarily add.

When a key is revoked in a CSR, is the hash of the public key mentioned in the CSR or just the PKI-stamped version of the Public key?

For argument's sake, suppose I want to use the same RSA pub/private key pair for many usages, even though this may be a bad idea in reality. As a result I generate 3 certs, with the respective EKU below

  • Signing
  • Authentication
  • Encryption

Will a revocation affect all three usages of the same private key? Or will the revocation only affect a given cert?

Improve this question

1 Answer 1

Reset to default
0

Based on this answer from Thomas Pornin:

Revocation is on per-certificate basis. What is revoked is the certificate (i.e. the binding between your key and your identity), not the key. Of course, if several CA have issued certificates that bind your key to your name, and your key gets stolen, then you would like all these certificates to be revoked. However, if one CA revokes your certificate for some other reason (e.g. you failed to pay a yearly "certificate maintenance" fee), then this has no impact on the revocation status of certificates issued by other CA, even if they contain the same name (yours) and the same public key (also yours) as the revoked certificate.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .