Questions tagged [crl]
A certificate revocation list (CRL) is a list of certificates that have been revoked and hence should not be trusted.
54
questions
1
vote
1
answer
2k
views
is it necessary for cURL to check for CRL in Windows?
I'm trying to set up cURL to get data from remote server at any sitaution. I use --tlsv1.3 --tls13-ciphers TLS_CHACHA20_POLY1305_SHA256 --http2 to make it as secure as I can think of, using Windows 11....
user286246
1
vote
1
answer
1k
views
Firewall is blocking OCSP (Online Certificate Status Protocol) check
I have a certificate issued by lets encrypt and one of the certificate in the path has this information:
[1]CRL Distribution Point
Distribution Point Name:
Full Name:
URL=...
- 2,267
0
votes
1
answer
85
views
OpenSSL and connection time
Does anyone know about the search mechanism used in OpenSSL w.r.t verifying a serial number against a CRL file?
I understand that in the case of Base-CRL approach, the file size will grow over time ...
0
votes
1
answer
484
views
Should root certificates have OCSP or CRL for it? [duplicate]
Should root certificates have OCSP or CRL for its own revocation status?
So here is what I mean:
Intermediate Cert -> http://example.com/root.crl
SAN Cert -> https://example.com/intermediate.crl
...
- 153
19
votes
5
answers
9k
views
CRL over HTTPS: is it really a bad practice?
On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either
it causes a chicken-and-egg problem when checking for ...
1
vote
2
answers
530
views
Practical usage of CRL(Certificate Revocation List)
Does the CA need to mandatorily publish the new CRL file even though there are no new certificates that have been compromised since the last CRL published?
If CA needs to publish the CRL's ...
0
votes
1
answer
1k
views
Certificate Revocation with intermediate CAs - combine CRLs?
I use Nginx for client-side authentication.
Only the SSL-certificates from the User CA should have access to the application.
The CA hierarchy:
Root CA
|
Intermediate CA
|
User CA
So ...
5
votes
0
answers
2k
views
Openssl cms verify signature with timestamp and crl
I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
- 768
1
vote
1
answer
2k
views
Correct CRL and OSCP URIs along certificate chain
Merely because of private interest and usage in my own network, I'm creating a certificate chain (Root CA → Intermediate CA → Server cert) using openssl. I'd like the certificate chain to be ...
- 143
0
votes
2
answers
190
views
Who/what maintains the CRL for a web server's client certs?
In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process.
Is it really a ...
- 231
1
vote
0
answers
121
views
Mix OCSP stapling + CRL in a hierarchy of CAs
In an architecture with a root CA and a daughter CA, is it possible to combine OCSP stapling and CRL check?
More precisely, is it possible for a client:
to connect to an https server
verify the ...
- 35
10
votes
1
answer
3k
views
How well do current browsers handle certificate revocation?
I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. "An end-to-end measurement of certificate revocation in the web's PKI." Proceedings of the 2015 Internet Measurement Conference. ...
- 133
1
vote
1
answer
317
views
What's the goal behind signing a CRL with an old certificate key?
I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
- 39
0
votes
2
answers
150
views
Assuming that everyone always performs a revocation check, do we still need expiration time in each certificate? [duplicate]
I understand that each public key certificate includes an expiration time, and a CRL is issued periodically, listing all currently revoked certificates. However, in class we were told to think about ...
- 1
1
vote
0
answers
91
views
Revocation list for a custom solution
If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
- 283
0
votes
1
answer
3k
views
How to automate publication of CRL and CRT files to CDP and AIA location?
I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
- 101
4
votes
1
answer
311
views
Under what conditions is the Client trying "the next" CRL Distribution Point?
We've got a scenario where the CRL is distributed to 2 different Locations.
One ist accessable from a private network and not from the internet.
The other one is asseccable from the internet but not ...
- 41
0
votes
4
answers
435
views
Why are CRLs used instead of "valid certificates lists" and inner workings of CRLs
I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists).
In my opinion this is kind of weird. A CA has to ...
- 128
14
votes
2
answers
10k
views
Definitions for CRL Reasons
Is there any authoritative definition of the various reasons possible in a CRL file? Section 6.3.2(b) of RFC5280 lists a few:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
...
- 243
12
votes
2
answers
3k
views
Are revoked certificates removed from CRLs after expiration? Why is this secure?
If a certificate is revoked before its expiry time and added to a CRL, is it removed from the CRL after the certificate validity period expires? RFC 5280 seems to imply this:
A complete CRL lists all ...
- 223
1
vote
0
answers
131
views
Why wouldn't you check the revocation status of the root certificate? [duplicate]
In this page on Microsoft's ADFS trust policy, it states:
most revocation checks exclude checking the root certificate
What is the reason for this? Why wouldn't you want to check the whole ...
- 169
0
votes
2
answers
770
views
How do I use crlDistributionPoints with keytool?
I'm using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL.
However I need to configure crlDistributionPoints extension as described in the RFC 5280.
...
- 689
4
votes
1
answer
988
views
Can we use one CA to revoke certificates generated by another CA?
I have a hierarchy of certificates which contains:
root-cert
server1-CA (issued from root-CA)
client1-cert (issued from server1-CA)
server2-CA (issued from root-CA)
client2-cert (issued from ...
- 689
1
vote
1
answer
5k
views
How can SEC_ERROR_REVOKED_CERTIFICATE in firefox be further examined?
A https website, which is not under my control, leads to an error message SEC_ERROR_REVOKED_CERTIFICATE in Firefox 51.
The CRL (url embedded in the certificate) does not distrust the sites certificate....
user88348
3
votes
1
answer
587
views
OCSP Responder certificate - CRL distribution points and AIA OCSP URI
I am building OCSP responder and I need to issue OCSP Signer certificate from CA that will be used to sign OCSP responses.
In a definition of certificate profile for OCSP Signer certificate, should I ...
- 1,119
0
votes
1
answer
714
views
openssl crl "Error getting CRL issuer certificate" reasons
CRL file A - http://pastebin.com/ZXGk9p0X
CA file B in directory "dir1" http://pastebin.com/05PKGCjH
openssl crl -in A -CApath dir1
gives the error
Error getting CRL issuer certificate
I had ...
- 2,022
4
votes
1
answer
2k
views
"openssl crl" verify gives "Error getting CRL issuer certificate"
File A - This is my CRL File - http://pastebin.com/yvstfPTD
File B - It's signed by this cert - http://pastebin.com/T1pXZSat
File C - The CRL signing cert has been issued by this CA http://pastebin....
- 2,022
1
vote
1
answer
147
views
HTTP methods to be supported for CRL downloading
I was not able to find anywhere in the RFCs which HTTP methods must be supported by the conformant CAs in order to allow users to download CRL.
What are the mandatory HTTP methods (GET, HEAD, ...) ...
- 469
0
votes
1
answer
140
views
OCSP from branch office to central office
Our firm wants to validate certificates using OCSP in its branch offices.
However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right ...
- 1
3
votes
2
answers
861
views
S/MIME signed e-mail, CRL ?
Are CRL lookups performed when receiving a S/MIME signed e-mail or onyl when it's encrypted ?
- 1,558
2
votes
1
answer
2k
views
Why not set Root CA CRL for Sub-CA to be really long?
I am designing a two-tier AD-CS PKI and when it comes to the Root CA I am struggling to understand the validity period of the CRL which is used to validate the sub-CAs by end entitites.
Documentation ...
- 21
1
vote
0
answers
6k
views
(net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION)
why do I get There are issues with the site's certificate chain (net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION) in chrome when accessing an https page?
according to https://bugs.chromium.org/p/chromium/...
- 1,558
0
votes
1
answer
437
views
Should updated CRLs be published even if no new certs have been revoked?
Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in default_crl_days when the certificate was generated?
...
- 12.8k
1
vote
1
answer
558
views
Revocation of intermediate trusted CA
My question is related to the revocation of intermediate CA. Suppose I have a device that performs the revocation checks on the whole chain and assigns the intermediate CA's a trusted level.Now ...
- 161
5
votes
1
answer
4k
views
Does Firefox use OCSP?
And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
- 1,399
0
votes
1
answer
176
views
Can a CRL file contain multiple full stops in its name?
Will a CRL file name such as fred.freddy.domain.crl work for a Certificate Revocation List URL? I cannot find any documentation to state that it will not work.
Closest that I have found is a ...
- 3
8
votes
3
answers
3k
views
X509 CRL suspended certificates and openssl ca comand
In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it.
...
4
votes
0
answers
502
views
Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?
I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
- 41
28
votes
3
answers
3k
views
Does any technology prevent a CA unilaterally revoking a certificate?
As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP).
In an increasingly TLS world, what current technology stops a CA shutting ...
- 1,122
1
vote
1
answer
2k
views
TinyCA missing CRL information in root and leaf certificates
I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem
And I have exported the CRL to that location, and I ...
- 159
2
votes
1
answer
97
views
Questions regarding CRLs (producedAt and not modified)
I have two questions regarding the safety of requesting CRLs.
My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
- 189
3
votes
1
answer
1k
views
TLS - How to know a CRL URL is not changed
If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
- 189
5
votes
1
answer
3k
views
Which CRL should an intermediate CA crlDistributionPoint contain?
Given a root certificate authority (CA) and an intermediate CA signed by the root:
Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the intermediate ...
- 153
2
votes
1
answer
2k
views
How to revoke certificates, or generate CRL files with Keytool
I didn't find how to use java keytool to revoke certificates or generate CRL files.
Is it possible to do that with keytool?
If no, how to do it with openssl ?
- 689
1
vote
1
answer
609
views
CRL verification with renewed CA
I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed.
Suppose I have the following setup:
...
- 1,119
3
votes
1
answer
711
views
RemoveFromCRL and DeltaCRL
I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason.
At the start, PKI has revoked the certificate with certificateHold reason.
And create next CRL:
Last Update: May ...
- 133
11
votes
1
answer
4k
views
Should I use a Certificate Revocation List?
I've been trying to provide security to my API.
I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication.
I'm wondering, should I use ...
- 342
4
votes
1
answer
94
views
Mail Signing Certificate – What are the impacts when revocated?
Suppose I open a signed mail on 1st January 2000, signature is OK.
What about this two cases :
1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
- 717
0
votes
2
answers
751
views
Check signature when next CRL will be published after end of validity of certificate
My situation looks like this:
I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revoked. But what if certificate ...
- 5
25
votes
3
answers
12k
views
Is publishing CRLs over HTTP a potential vulnerability?
I noticed that at least one major CA (Comodo) publishes their CRL over HTTP rather than HTTPS.
This seems to me to be somewhat of a vulnerability, as an attacker could hijack the HTTP connection that ...
- 7,755