Questions tagged [certificate-revocation]

Certificate Revocation is a process for reporting that a certificate should no longer be trusted to the cert's issuing CA. The CA then places the cert on its CRL, and responds "REVOKED" to any OCSP requests for that cert. Normally only the owner of the cert (holder of the private key) can revoke a cert, though in special circumstances a CA can revoke a cert directly.

Filter by
Sorted by
Tagged with
1
vote
2answers
82 views

Why infamous Addtrust certificate is still not expired (same private key) for code signing?

As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
1
vote
0answers
67 views

openSSL shows a revoked certificate as secure

I downloaded a revoked certificate from the website https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/. Specifically, the revoked certificate of the site https://revoked-rsa-ev....
0
votes
0answers
31 views

Certificate Revocation with intermediate CAs - combine CRLs?

I use Nginx for client-side authentication. Only the SSL-certificates from the User CA should have access to the application. The CA hierarchy: Root CA | Intermediate CA | User CA So ...
0
votes
0answers
43 views

Which CAs is more vulnerable to compromise or misbehave in the trust chain (Root, Intermediate or Issuing CA)?

From the academic and real-world scenarios which CAs are more prone to misbehavior or compromise by attackers (Root, Intermediate or issuing CAs)? What are the consequences after compromise? Are the ...
1
vote
1answer
57 views

Does a revocation certificate leak information about the private key?

Kleopatra/ GPG can create revocation certificates, which look a lot like public/private keys. Obviously, these keys should not be shared or used unless one intends to revoke their keys. But assume ...
1
vote
1answer
106 views

Correct CRL and OSCP URIs along certificate chain

Merely because of private interest and usage in my own network, I'm creating a certificate chain (Root CA → Intermediate CA → Server cert) using openssl. I'd like the certificate chain to be ...
0
votes
1answer
99 views

StrongSwan, IPsec remote certs and cert_policy

I'm looking for a way to limit the certs that my IPsec can accept. I'm using StrongSwan (swanctl version 5.7), I want to accept only certs coming from a remote with a name of yoji.*.example.com I ...
0
votes
0answers
80 views

Check CRLs of signed JARs

I have a signed JAR. How could I check if the corresponding code-signing certificate was revoked? Technically there seem to be the following options: The Java TrustStore holds CRLs/revoked ...
1
vote
1answer
125 views

Does it serve any purpose to have a CRL with the next update scheduled for 25 years in the future?

What purpose does it serve to have a CRL with nextUpdate set to +25 years? A CRL issued by the root of an operating Certificate Authority Certificate Revocation List (CRL): Version 2 (0x1) ...
9
votes
1answer
404 views

How well do current browsers handle certificate revocation?

I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. "An end-to-end measurement of certificate revocation in the web's PKI." Proceedings of the 2015 Internet Measurement Conference. ...
0
votes
0answers
84 views

How to revoke a client certificate using openssl

I generated a private key and a certificate for my CA: ca.key ca.pem Then I generated a client certificate for a user: openssl ecparam -genkey -name prime256v1 | openssl ec -out user.key openssl ...
-6
votes
2answers
192 views

Revoke Let's Encrypt CA for all devices in my organization?

If I disagree with Let's Encrypt's cavalier attitude about SSL certificate issuance, and their indifference to their auto-generated certificates potentially being using for widespread criminal ...
2
votes
2answers
124 views

Revoking a Certificate

I'm looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for ...
3
votes
1answer
362 views

Does revoking a certificate result in revocation of its key?

If I request my identity certificate to be revoked for any reason other than key compromise, would the private key also be revoked in result?
5
votes
2answers
256 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
1
vote
1answer
161 views

OCSP responseStatus, is it really useful?

Based on RFC-6960 an OCSP Response should have the following as a minimum: OCSPResponse ::= SEQUENCE { responseStatus OCSPResponseStatus, responseBytes [0] EXPLICIT ResponseBytes ...
0
votes
1answer
119 views

ADCS two tier PKI

Planning a two tier ADCS PKI infrastructure as follows: ORCA ____________|____________ | | | SCA1 SCA2 SCA3 one.int two.int three.int ...
1
vote
0answers
40 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
1
vote
1answer
681 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
1
vote
1answer
152 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
1
vote
1answer
604 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
1
vote
1answer
233 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
0
votes
4answers
160 views

Why are CRLs used instead of “valid certificates lists” and inner workings of CRLs

I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists). In my opinion this is kind of weird. A CA has to ...
0
votes
1answer
2k views

Google certificate gcp.gvt2.com untrusted / expired?

My antivirus noted gcp.gvt2.com certificate is expired today, gvt2.com alegently used by google analytics. It might to do with Google distrust of Symantec https://security.googleblog.com/2018/03/...
1
vote
0answers
117 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
0
votes
2answers
201 views

Certificate Authentication from untrusted IP address

When I launch my Windows, certificate revocation checks are performed. These occur once when explorer.exe is launched then periodically, every 40 minutes approximately, to 5 IPs. Most of these target ...
3
votes
1answer
416 views

GnuPG sub-keys revocation

My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored ...
10
votes
4answers
2k views

Can a revoked certificate be re-instated?

If a certificate is revoked, can it be re-instated, or is the only option to generate a new one?
11
votes
1answer
352 views

Do long lived TLS connections pose a security risk?

I would like to better understand the implications of maintaining a long lived (hours, days) TLS connection with respect to certificate revocation. As I understand TLS, the client verifies the server'...
1
vote
1answer
151 views

User mail certificates policy: Is expiration+renewal better than no-expiration+revocation?

In our environment, we provide user certificates to sign or encrypt emails. This is an internal setting, meaning the CA is internal to our organization (not a public CA) and handled by our Active ...
4
votes
1answer
3k views

Revoked cert not showing revoked in Chrome 64.0.3282.186

As far as I can tell (ssllabs.com / ssldecoder.org) the certificate for www.sarahah.com has been revoked: Serial C1:18:2F:1A:91:A9:0E:03 CRL - Revoked on CRL: http://crl.godaddy.com/gdig2s1-792.crl ...
1
vote
0answers
78 views

Certificate revocation with reason code removeFromCRL

RFC 5280 says: "The removeFromCRL (8) reasonCode value may only appear in delta CRLs and indicates that a certificate is to be removed from a CRL because either the certificate expired or was removed ...
5
votes
1answer
1k views

What is the status of Certificate Transparency?

I am reading a bit on the certificate transparancy project initiazed by google. (More info at http://www.certificate-transparency.org), this technology tries to introduce transparency in the creation ...
7
votes
3answers
8k views

Is the Offline Root CA Obsolete?

There are countless “how-to” articles and best practices recommending use of an offline root certificate authority (CA). Though as the title suggests, is this recommendation obsolete? The context of ...
4
votes
1answer
300 views

Certificate and key abuse

I made a mistake several years ago by uploading OpenSSL certificate key (.pem and .pk8) into a blog post. The key was used to sign Android apk using SignApk.jar tool. Someone took it and used the key ...
0
votes
0answers
12k views

Converting .pem to .key file

I downloaded certificated for my website using letsencrypt: letsencrypt -d crackerscreed.me --manual --preferred-challenges dns certonly The process was successful but the site I want to implement ...
3
votes
1answer
70 views

Are all (or most) expired certificates issued by 3rd party certificate authorities also marked as revoked?

In a recent online course, an instructor stated: Once you've created a certificate, eventually you are going to have to revoke it, and even if that's just to renew it, really, I mean if you ...
1
vote
0answers
658 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
2
votes
2answers
8k views

How do I revoke the certificate and generate a CRL?

I created a self-signed CA certificate, and then created a client certificate using this tutorial here. I am just trying to revoke the client certificate: openssl ca -keyfile rootCA.key -cert rootCA....
1
vote
0answers
81 views

Why wouldn't you check the revocation status of the root certificate? [duplicate]

In this page on Microsoft's ADFS trust policy, it states: most revocation checks exclude checking the root certificate What is the reason for this? Why wouldn't you want to check the whole ...
89
votes
4answers
10k views

Should I revoke no longer used Let's Encrypt certificates before destroying them?

The Let's Encrypt documentation recommends that when a certificate’s corresponding private key is no longer safe, you should revoke the certificate. But should you do the same if there are no ...
5
votes
2answers
273 views

Certificate Transparency: Log a legit precertificate and issue a rogue certificate

I'm trying to understand how Certificate Transparency solves the problem with dishonest Certificate Authorities embedding an SCT in their certificates. I understand that the log is append-only, and ...
0
votes
1answer
114 views

Is the windows root trust store used by IE?

With the Symantec-Google drama, it would help to know if the Internet Explorer browser has its own root trust store built in to the browser, or uses the automatically updating Windows System root ...
4
votes
1answer
116 views

How are root CA revocations handled?

Considering some CA certificates are hardcoded into operating systems, I was wondering what happens when one of these hardcoded certificates is revoked (put on a revocation list for example) because ...
2
votes
3answers
192 views

Certificate chain and permission to revoke

We have given a certificate chain: X <-- Y <-- Z (X is an end-entity cert, Z is root CA). Certificates are extended with CRL distribution points info. Because of the fact Y -> X Y is a CA ...
0
votes
1answer
182 views

Why would a commercial CA issue dup root?

I just ran across a keystore (generated and managed using IBM's GSKit) that has two root certificates with the same Subject DN and same key: Subject : "CN=Entrust.net Certification Authority (2048),...
0
votes
1answer
256 views

OCSP stapling Alice and Bob

In the case of OCSP stapling in the browsers, it works this way. But my question is, in a case where I have a communication between Alice and Bob how this works? I know that if I use OCSP normal, both ...
3
votes
3answers
65 views

Is it possible to identify outstanding ssl certificates?

Is it possible to identify what certificate authorities has put out valid certificates for a given domain? For example, if my server leaves my control for some period of time is it possible to ...
1
vote
1answer
435 views

Is the use of regular OCSP or OCSP stapling a privacy risk?

Is the use of regular OCSP or OCSP stapling a privacy risk? Since a request is sent (in each handshake) to an (external) OCSP Responder. The OCSP responder can potentially register a load of ...
7
votes
2answers
2k views

What is the exact difference between regular OCSP and OCSP stapling?

What is the exact difference between the Online Certificate Status Protocol (OCSP) and OCSP stapling, which seems to be "...an alternative approach to the Online Certificate Status Protocol (OCSP)"?