Questions tagged [crl]

A certificate revocation list (CRL) is a list of certificates that have been revoked and hence should not be trusted.

Filter by
Sorted by
Tagged with
1
vote
1answer
83 views

What's the goal behind signing a CRL with an old certificate key?

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
0
votes
2answers
94 views

Assuming that everyone always performs a revocation check, do we still need expiration time in each certificate? [duplicate]

I understand that each public key certificate includes an expiration time, and a CRL is issued periodically, listing all currently revoked certificates. However, in class we were told to think about ...
1
vote
0answers
38 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
0
votes
1answer
49 views

How to automate publication of CRL and CRT files to CDP and AIA location?

I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
4
votes
1answer
50 views

Under what conditions is the Client trying “the next” CRL Distribution Point?

We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not ...
0
votes
4answers
115 views

Why are CRLs used instead of “valid certificates lists” and inner workings of CRLs

I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists). In my opinion this is kind of weird. A CA has to ...
7
votes
2answers
2k views

Definitions for CRL Reasons

Is there any authoritative definition of the various reasons possible in a CRL file? Section 6.3.2(b) of RFC5280 lists a few: unspecified keyCompromise cACompromise affiliationChanged superseded ...
10
votes
1answer
933 views

Are revoked certificates removed from CRLs after expiration? Why is this secure?

If a certificate is revoked before its expiry time and added to a CRL, is it removed from the CRL after the certificate validity period expires? RFC 5280 seems to imply this: A complete CRL lists ...
1
vote
0answers
75 views

Why wouldn't you check the revocation status of the root certificate? [duplicate]

In this page on Microsoft's ADFS trust policy, it states: most revocation checks exclude checking the root certificate What is the reason for this? Why wouldn't you want to check the whole ...
0
votes
2answers
390 views

How do I use crlDistributionPoints with keytool?

I'm using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL. However I need to configure crlDistributionPoints extension as described in the RFC 5280. ...
2
votes
1answer
358 views

Can we use one CA to revoke certificates generated by another CA?

I have a hierarchy of certificates which contains: root-cert server1-CA (issued from root-CA) client1-cert (issued from server1-CA) server2-CA (issued from root-CA) client2-cert (issued from ...
1
vote
1answer
5k views

How can SEC_ERROR_REVOKED_CERTIFICATE in firefox be further examined?

A https website, which is not under my control, leads to an error message SEC_ERROR_REVOKED_CERTIFICATE in Firefox 51. The CRL (url embedded in the certificate) does not distrust the sites certificate....
3
votes
1answer
243 views

OCSP Responder certificate - CRL distribution points and AIA OCSP URI

I am building OCSP responder and I need to issue OCSP Signer certificate from CA that will be used to sign OCSP responses. In a definition of certificate profile for OCSP Signer certificate, should I ...
0
votes
1answer
296 views

openssl crl “Error getting CRL issuer certificate” reasons

CRL file A - http://pastebin.com/ZXGk9p0X CA file B in directory "dir1" http://pastebin.com/05PKGCjH openssl crl -in A -CApath dir1 gives the error Error getting CRL issuer certificate I had ...
2
votes
1answer
556 views

“openssl crl” verify gives “Error getting CRL issuer certificate”

File A - This is my CRL File - http://pastebin.com/yvstfPTD File B - It's signed by this cert - http://pastebin.com/T1pXZSat File C - The CRL signing cert has been issued by this CA http://pastebin....
1
vote
1answer
47 views

HTTP methods to be supported for CRL downloading

I was not able to find anywhere in the RFCs which HTTP methods must be supported by the conformant CAs in order to allow users to download CRL. What are the mandatory HTTP methods (GET, HEAD, ...) ...
0
votes
1answer
94 views

OCSP from branch office to central office

Our firm wants to validate certificates using OCSP in its branch offices. However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right ...
3
votes
2answers
299 views

S/MIME signed e-mail, CRL ?

Are CRL lookups performed when receiving a S/MIME signed e-mail or onyl when it's encrypted ?
2
votes
1answer
840 views

Why not set Root CA CRL for Sub-CA to be really long?

I am designing a two-tier AD-CS PKI and when it comes to the Root CA I am struggling to understand the validity period of the CRL which is used to validate the sub-CAs by end entitites. Documentation ...
0
votes
0answers
2k views

(net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION)

why do I get There are issues with the site's certificate chain (net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION) in chrome when accessing an https page? according to https://bugs.chromium.org/p/chromium/...
0
votes
1answer
97 views

Should updated CRLs be published even if no new certs have been revoked?

Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in default_crl_days when the certificate was generated? ...
1
vote
1answer
299 views

Revocation of intermediate trusted CA

My question is related to the revocation of intermediate CA. Suppose I have a device that performs the revocation checks on the whole chain and assigns the intermediate CA's a trusted level.Now ...
4
votes
1answer
2k views

Does Firefox use OCSP?

And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
0
votes
1answer
74 views

Can a CRL file contain multiple full stops in its name?

Will a CRL file name such as fred.freddy.domain.crl work for a Certificate Revocation List URL? I cannot find any documentation to state that it will not work. Closest that I have found is a ...
5
votes
3answers
1k views

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
3
votes
0answers
360 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
28
votes
3answers
2k views

Does any technology prevent a CA unilaterally revoking a certificate?

As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP). In an increasingly TLS world, what current technology stops a CA shutting ...
1
vote
1answer
1k views

TinyCA missing CRL information in root and leaf certificates

I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem And I have exported the CRL to that location, and I ...
2
votes
1answer
46 views

Questions regarding CRLs (producedAt and not modified)

I have two questions regarding the safety of requesting CRLs. My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
3
votes
1answer
636 views

TLS - How to know a CRL URL is not changed

If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
2
votes
1answer
2k views

Which CRL should an intermediate CA crlDistributionPoint contain?

Given a root certificate authority (CA) and an intermediate CA signed by the root: Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the intermediate ...
2
votes
1answer
1k views

How to revoke certificates, or generate CRL files with Keytool

I didn't find how to use java keytool to revoke certificates or generate CRL files. Is it possible to do that with keytool? If no, how to do it with openssl ?
1
vote
1answer
359 views

CRL verification with renewed CA

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed. Suppose I have the following setup: ...
3
votes
1answer
384 views

RemoveFromCRL and DeltaCRL

I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason. At the start, PKI has revoked the certificate with certificateHold reason. And create next CRL: Last Update: May ...
11
votes
1answer
2k views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
4
votes
1answer
56 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
0
votes
2answers
382 views

Check signature when next CRL will be published after end of validity of certificate

My situation looks like this: I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revoked. But what if certificate ...
18
votes
3answers
6k views

Is publishing CRLs over HTTP a potential vulnerability?

I noticed that at least one major CA (Comodo) publishes their CRL over HTTP rather than HTTPS. This seems to me to be somewhat of a vulnerability, as an attacker could hijack the HTTP connection that ...
2
votes
2answers
232 views

Should expired compromised certificates be taken care of if the time is always correct?

I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration. In my case, the root certificate of CA is ...
0
votes
1answer
11k views

Verify Certificate is revoked by CRL

I set up a CA and signed some cert request. I revoke them by: openssl ca -config config.cnf -revoke cert.pem I update CRL by: openssl ca -config config.cnf -gencrl -out crl/crl.pem index.txt ...
2
votes
1answer
143 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
4
votes
3answers
2k views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...