Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [certificate-revocation]

Certificate Revocation is a process for reporting that a certificate should no longer be trusted to the cert's issuing CA. The CA then places the cert on its CRL, and responds "REVOKED" to any OCSP requests for that cert. Normally only the owner of the cert (holder of the private key) can revoke a ...

1
vote
1answer
117 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
1
vote
1answer
59 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
0
votes
4answers
83 views

Why are CRLs used instead of “valid certificates lists” and inner workings of CRLs

I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists). In my opinion this is kind of weird. A CA has to ...
0
votes
1answer
242 views

Google certificate gcp.gvt2.com untrusted / expired?

My antivirus noted gcp.gvt2.com certificate is expired today, gvt2.com alegently used by google analytics. It might to do with Google distrust of Symantec https://security.googleblog.com/2018/03/...
1
vote
0answers
38 views

Product & Feature Comparison of EJBCA, Active Directory Certificate Services, or Entrust Authority Security Manager?

I'm currently beginning analysis in this field and stumbled across the thread titled: "Comparison and difference between CAs" The question seems largely unresolved. Does there exist any product or ...
0
votes
2answers
71 views

Certificate Authentication from untrusted IP address

When I launch my Windows, certificate revocation checks are performed. These occur once when explorer.exe is launched then periodically, every 40 minutes approximately, to 5 IPs. Most of these target ...
0
votes
0answers
129 views

openssl CLI - verify CRL of an entire certification chain

I'm using OpenSSL to verify a signed code in a custom PKI. How can I verify the CRL of each node of the cert hierarchy. My hierarchy is : RootCA -> SubCA1 -> SubCA2 -> EndUser. I can verify the CRL ...
1
vote
1answer
36 views

GnuPG sub-keys revocation

My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored ...
7
votes
3answers
700 views

Can a revoked certificate be re-instated?

If a certificate is revoked, can it be re-instated, or is the only option to generate a new one?
5
votes
0answers
101 views

Do long lived TLS connections pose a security risk?

I would like to better understand the implications of maintaining a long lived (hours, days) TLS connection with respect to certificate revocation. As I understand TLS, the client verifies the server'...
1
vote
1answer
88 views

User mail certificates policy: Is expiration+renewal better than no-expiration+revocation?

In our environment, we provide user certificates to sign or encrypt emails. This is an internal setting, meaning the CA is internal to our organization (not a public CA) and handled by our Active ...
2
votes
1answer
965 views

Revoked cert not showing revoked in Chrome 64.0.3282.186

As far as I can tell (ssllabs.com / ssldecoder.org) the certificate for www.sarahah.com has been revoked: Serial C1:18:2F:1A:91:A9:0E:03 CRL - Revoked on CRL: http://crl.godaddy.com/gdig2s1-792.crl ...
1
vote
0answers
24 views

Certificate revocation with reason code removeFromCRL

RFC 5280 says: "The removeFromCRL (8) reasonCode value may only appear in delta CRLs and indicates that a certificate is to be removed from a CRL because either the certificate expired or was removed ...
2
votes
1answer
455 views

What is the status of Certificate Transparency?

I am reading a bit on the certificate transparancy project initiazed by google. (More info at http://www.certificate-transparency.org), this technology tries to introduce transparency in the creation ...
7
votes
3answers
2k views

Is the Offline Root CA Obsolete?

There are countless “how-to” articles and best practices recommending use of an offline root certificate authority (CA). Though as the title suggests, is this recommendation obsolete? The context of ...
4
votes
1answer
226 views

Certificate and key abuse

I made a mistake several years ago by uploading OpenSSL certificate key (.pem and .pk8) into a blog post. The key was used to sign Android apk using SignApk.jar tool. Someone took it and used the key ...
0
votes
0answers
4k views

Converting .pem to .key file

I downloaded certificated for my website using letsencrypt: letsencrypt -d crackerscreed.me --manual --preferred-challenges dns certonly The process was successful but the site I want to implement ...
3
votes
1answer
67 views

Are all (or most) expired certificates issued by 3rd party certificate authorities also marked as revoked?

In a recent online course, an instructor stated: Once you've created a certificate, eventually you are going to have to revoke it, and even if that's just to renew it, really, I mean if you ...
1
vote
0answers
340 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
1
vote
1answer
3k views

How do I revoke the certificate and generate a CRL?

I created a self-signed CA certificate, and then created a client certificate using this tutorial here. I am just trying to revoke the client certificate: openssl ca -keyfile rootCA.key -cert rootCA....
1
vote
0answers
68 views

Why wouldn't you check the revocation status of the root certificate? [duplicate]

In this page on Microsoft's ADFS trust policy, it states: most revocation checks exclude checking the root certificate What is the reason for this? Why wouldn't you want to check the whole ...
89
votes
4answers
9k views

Should I revoke no longer used Let's Encrypt certificates before destroying them?

The Let's Encrypt documentation recommends that when a certificate’s corresponding private key is no longer safe, you should revoke the certificate. But should you do the same if there are no ...
5
votes
2answers
180 views

Certificate Transparency: Log a legit precertificate and issue a rogue certificate

I'm trying to understand how Certificate Transparency solves the problem with dishonest Certificate Authorities embedding an SCT in their certificates. I understand that the log is append-only, and ...
0
votes
1answer
93 views

Is the windows root trust store used by IE?

With the Symantec-Google drama, it would help to know if the Internet Explorer browser has its own root trust store built in to the browser, or uses the automatically updating Windows System root ...
4
votes
1answer
109 views

How are root CA revocations handled?

Considering some CA certificates are hardcoded into operating systems, I was wondering what happens when one of these hardcoded certificates is revoked (put on a revocation list for example) because ...
2
votes
3answers
110 views

Certificate chain and permission to revoke

We have given a certificate chain: X <-- Y <-- Z (X is an end-entity cert, Z is root CA). Certificates are extended with CRL distribution points info. Because of the fact Y -> X Y is a CA ...
0
votes
1answer
94 views

Why would a commercial CA issue dup root?

I just ran across a keystore (generated and managed using IBM's GSKit) that has two root certificates with the same Subject DN and same key: Subject : "CN=Entrust.net Certification Authority (2048),...
0
votes
1answer
120 views

OCSP stapling Alice and Bob

In the case of OCSP stapling in the browsers, it works this way. But my question is, in a case where I have a communication between Alice and Bob how this works? I know that if I use OCSP normal, both ...
3
votes
3answers
61 views

Is it possible to identify outstanding ssl certificates?

Is it possible to identify what certificate authorities has put out valid certificates for a given domain? For example, if my server leaves my control for some period of time is it possible to ...
1
vote
1answer
267 views

Is the use of regular OCSP or OCSP stapling a privacy risk?

Is the use of regular OCSP or OCSP stapling a privacy risk? Since a request is sent (in each handshake) to an (external) OCSP Responder. The OCSP responder can potentially register a load of ...
6
votes
2answers
776 views

What is the exact difference between regular OCSP and OCSP stapling?

What is the exact difference between the Online Certificate Status Protocol (OCSP) and OCSP stapling, which seems to be "...an alternative approach to the Online Certificate Status Protocol (OCSP)"?
1
vote
0answers
85 views

MQTT + TLS client not accepting to connect with new root when cross certificate is present

I am trying to connect an MQTT client to a server over MQTTS (MTTQ + TLS). The server provides 3 certificates: the cert of the MQTT endpoint, an intermediate certificate (RapidSSL) signed with ...
3
votes
1answer
971 views

Is there a tool that reports on PKI health (CRL dates, expiry, etc)?

I'm looking for a tool that will walk the AIA tree from a leaf node and check all corresponding CRL dates and times. Ideally it will also check versions and cross root trusts. Does such a tool exist?...
0
votes
2answers
295 views

How do I use crlDistributionPoints with keytool?

I'm using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL. However I need to configure crlDistributionPoints extension as described in the RFC 5280. ...
2
votes
1answer
210 views

Can we use one CA to revoke certificates generated by another CA?

I have a hierarchy of certificates which contains: root-cert server1-CA (issued from root-CA) client1-cert (issued from server1-CA) server2-CA (issued from root-CA) client2-cert (issued from ...
3
votes
1answer
112 views

Does an end user (or CA) certificate have any “fingerprinting” to indicate the brand of PKI being used?

As part of my forensics, I want to determine if a given certificate has any indicator of which PKI software was used to create it. So far, I see differences in the following properties for a ...
2
votes
1answer
171 views

Decryption After Public-Private Key Pair Revocation

Once a key pair has been revoked, is it still possible to decrypt messages that were previously encrypted? What if the key is / isn't protected with a strong passphrase? From what I understand, it ...
0
votes
1answer
266 views

Apache: Can I revoke certain client certificate on certain subdomain only

I would like to know if we can make the client certificate valid for certain sub domain (Virtual Host). For example if I have two client certificate A, B. A is valid for subdomainX but not for ...
1
vote
0answers
148 views

Can I revoke a CRL-signing certificate by using split CRLs?

I'm setting up an X.509 certificate authority that will issue only three types of certificate: Subordinate CA certificates, CRL-signing certificates, and OCSP responder certificates I'm interested ...
3
votes
1answer
126 views

Does GnuPG check for revocation certificates on keyserver automaticaly?

If a key was revoked, I may not know if the revocation key was published just after I downloaded the key with gpg --recv-key. Does GnuPG grant that it is up to date before using a key? Or do I need ...
1
vote
2answers
2k views

Is it enough to have Intermediate CA certificate in Trust store to validate a server certificate?

Lets assume that below is the chain: Server cert -> Intermediate1 -> Intermediate2 ->Root cert Below is the chain server sent to the client: Server cert -> Intermediate1 -> Intermediate2 I have ...
3
votes
3answers
1k views

GlobalSign Domain Validation CA revocation issue in all browsers

I don't know where to dig in to solve this. Hope for some advice Today suddenly soundcloud.com stopped working, with error "The certificate has and invalide issuer". The issue persists across all ...
0
votes
2answers
284 views

How self signed certificate works in https connection establishment [duplicate]

OS/Browser have Public Keys of all trusted CAs. Eg mozilla foundation have a list of 50+ trusted CA means that mainly the public key is already present in the browser. Now....some site say ...
3
votes
1answer
655 views

Certificate Revocation List (CRL) checking Best Practice

I have an application that uses TLS to secure communication between the two parties. The certificates involved have (Certificate Revocation List) CRL distribution points included. The CRL distribution ...
-1
votes
2answers
3k views

difference between OCSP, CRL and CDP [closed]

What is the difference between OCSP, CRL and CDP? Are OCSP and CRL the same? Can we use a CRL without configuring OCSP?
0
votes
1answer
66 views

Should updated CRLs be published even if no new certs have been revoked?

Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in default_crl_days when the certificate was generated? ...
0
votes
1answer
160 views

Is stolen client side certificate a valid concern for SSL communication? How to build an automatic revocation system?

In the context of server to server communication, we do TLS/SSL with client certificate authentication. So the communication looks like the following: service_a on Host_A (as the SSL client) --> ...
2
votes
0answers
138 views

Security Concerns of importing SharePoint Root Authority to Trusted Root Certification Authorities store

We are experiencing slowness because of SharePoint's STS certificate CRL checking. This is a known issue and there is a Microsoft Workaround for it: https://support.microsoft.com/en-us/kb/2625048 The ...
1
vote
1answer
224 views

Revocation of intermediate trusted CA

My question is related to the revocation of intermediate CA. Suppose I have a device that performs the revocation checks on the whole chain and assigns the intermediate CA's a trusted level.Now ...
0
votes
1answer
54 views

How do I know a certificate is not faked?

Assuming a situation in which Alice wants to send Bob an encrypted message by using a PKE, as far as I know, digital certificates allow both Alice and Bob to be sure that the public key they have is ...