Questions tagged [crl]
A certificate revocation list (CRL) is a list of certificates that have been revoked and hence should not be trusted.
0
votes
0answers
15 views
Unable to load crlnumber when creating CRL with OpenSSL [migrated]
I am trying to create a CRL with my own private CA with OpenSSL. I have to work on a Windows machine from the binary. I give the command:
$openssl ca -gencrl -config root-ca.conf -out root-ca.crl
...
1
vote
0answers
32 views
Revocation list for a custom solution
If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
0
votes
1answer
35 views
How to automate publication of CRL and CRT files to CDP and AIA location?
I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
4
votes
1answer
42 views
Under what conditions is the Client trying “the next” CRL Distribution Point?
We've got a scenario where the CRL is distributed to 2 different Locations.
One ist accessable from a private network and not from the internet.
The other one is asseccable from the internet but not ...
0
votes
4answers
106 views
Why are CRLs used instead of “valid certificates lists” and inner workings of CRLs
I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists).
In my opinion this is kind of weird. A CA has to ...
6
votes
2answers
1k views
Definitions for CRL Reasons
Is there any authoritative definition of the various reasons possible in a CRL file? Section 6.3.2(b) of RFC5280 lists a few:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
...
10
votes
1answer
886 views
Are revoked certificates removed from CRLs after expiration? Why is this secure?
If a certificate is revoked before its expiry time and added to a CRL, is it removed from the CRL after the certificate validity period expires? RFC 5280 seems to imply this:
A complete CRL lists ...
1
vote
0answers
75 views
Why wouldn't you check the revocation status of the root certificate? [duplicate]
In this page on Microsoft's ADFS trust policy, it states:
most revocation checks exclude checking the root certificate
What is the reason for this? Why wouldn't you want to check the whole ...
0
votes
2answers
373 views
How do I use crlDistributionPoints with keytool?
I'm using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL.
However I need to configure crlDistributionPoints extension as described in the RFC 5280.
...
2
votes
1answer
298 views
Can we use one CA to revoke certificates generated by another CA?
I have a hierarchy of certificates which contains:
root-cert
server1-CA (issued from root-CA)
client1-cert (issued from server1-CA)
server2-CA (issued from root-CA)
client2-cert (issued from ...
1
vote
1answer
5k views
How can SEC_ERROR_REVOKED_CERTIFICATE in firefox be further examined?
A https website, which is not under my control, leads to an error message SEC_ERROR_REVOKED_CERTIFICATE in Firefox 51.
The CRL (url embedded in the certificate) does not distrust the sites certificate....
3
votes
1answer
230 views
OCSP Responder certificate - CRL distribution points and AIA OCSP URI
I am building OCSP responder and I need to issue OCSP Signer certificate from CA that will be used to sign OCSP responses.
In a definition of certificate profile for OCSP Signer certificate, should I ...
0
votes
1answer
272 views
openssl crl “Error getting CRL issuer certificate” reasons
CRL file A - http://pastebin.com/ZXGk9p0X
CA file B in directory "dir1" http://pastebin.com/05PKGCjH
openssl crl -in A -CApath dir1
gives the error
Error getting CRL issuer certificate
I had ...
3
votes
1answer
514 views
“openssl crl” verify gives “Error getting CRL issuer certificate”
File A - This is my CRL File - http://pastebin.com/yvstfPTD
File B - It's signed by this cert - http://pastebin.com/T1pXZSat
File C - The CRL signing cert has been issued by this CA http://pastebin....
1
vote
1answer
47 views
HTTP methods to be supported for CRL downloading
I was not able to find anywhere in the RFCs which HTTP methods must be supported by the conformant CAs in order to allow users to download CRL.
What are the mandatory HTTP methods (GET, HEAD, ...) ...
0
votes
1answer
93 views
OCSP from branch office to central office
Our firm wants to validate certificates using OCSP in its branch offices.
However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right ...
3
votes
2answers
282 views
S/MIME signed e-mail, CRL ?
Are CRL lookups performed when receiving a S/MIME signed e-mail or onyl when it's encrypted ?
2
votes
1answer
801 views
Why not set Root CA CRL for Sub-CA to be really long?
I am designing a two-tier AD-CS PKI and when it comes to the Root CA I am struggling to understand the validity period of the CRL which is used to validate the sub-CAs by end entitites.
Documentation ...
0
votes
0answers
2k views
(net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION)
why do I get There are issues with the site's certificate chain (net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION) in chrome when accessing an https page?
according to https://bugs.chromium.org/p/chromium/...
0
votes
1answer
91 views
Should updated CRLs be published even if no new certs have been revoked?
Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in default_crl_days when the certificate was generated?
...
1
vote
1answer
271 views
Revocation of intermediate trusted CA
My question is related to the revocation of intermediate CA. Suppose I have a device that performs the revocation checks on the whole chain and assigns the intermediate CA's a trusted level.Now ...
4
votes
1answer
2k views
Does Firefox use OCSP?
And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
0
votes
1answer
71 views
Can a CRL file contain multiple full stops in its name?
Will a CRL file name such as fred.freddy.domain.crl work for a Certificate Revocation List URL? I cannot find any documentation to state that it will not work.
Closest that I have found is a ...
6
votes
3answers
1k views
X509 CRL suspended certificates and openssl ca comand
In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it.
...
4
votes
0answers
353 views
Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?
I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
28
votes
3answers
2k views
Does any technology prevent a CA unilaterally revoking a certificate?
As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP).
In an increasingly TLS world, what current technology stops a CA shutting ...
1
vote
1answer
1k views
TinyCA missing CRL information in root and leaf certificates
I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem
And I have exported the CRL to that location, and I ...
3
votes
1answer
46 views
Questions regarding CRLs (producedAt and not modified)
I have two questions regarding the safety of requesting CRLs.
My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
3
votes
1answer
594 views
TLS - How to know a CRL URL is not changed
If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
2
votes
1answer
1k views
Which CRL should an intermediate CA crlDistributionPoint contain?
Given a root certificate authority (CA) and an intermediate CA signed by the root:
Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the intermediate ...
2
votes
1answer
1k views
How to revoke certificates, or generate CRL files with Keytool
I didn't find how to use java keytool to revoke certificates or generate CRL files.
Is it possible to do that with keytool?
If no, how to do it with openssl ?
1
vote
1answer
349 views
CRL verification with renewed CA
I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed.
Suppose I have the following setup:
...
3
votes
1answer
377 views
RemoveFromCRL and DeltaCRL
I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason.
At the start, PKI has revoked the certificate with certificateHold reason.
And create next CRL:
Last Update: May ...
11
votes
1answer
2k views
Should I use a Certificate Revocation List?
I've been trying to provide security to my API.
I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication.
I'm wondering, should I use ...
4
votes
1answer
55 views
Mail Signing Certificate – What are the impacts when revocated?
Suppose I open a signed mail on 1st January 2000, signature is OK.
What about this two cases :
1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
0
votes
2answers
366 views
Check signature when next CRL will be published after end of validity of certificate
My situation looks like this:
I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revoked. But what if certificate ...
18
votes
3answers
6k views
Is publishing CRLs over HTTP a potential vulnerability?
I noticed that at least one major CA (Comodo) publishes their CRL over HTTP rather than HTTPS.
This seems to me to be somewhat of a vulnerability, as an attacker could hijack the HTTP connection that ...
2
votes
2answers
224 views
Should expired compromised certificates be taken care of if the time is always correct?
I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration.
In my case, the root certificate of CA is ...
0
votes
1answer
11k views
Verify Certificate is revoked by CRL
I set up a CA and signed some cert request.
I revoke them by:
openssl ca -config config.cnf -revoke cert.pem
I update CRL by:
openssl ca -config config.cnf -gencrl -out crl/crl.pem
index.txt ...
2
votes
1answer
142 views
How does checking CRLs make sites less safe?
With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
4
votes
3answers
2k views
How are CRLsets more secure?
Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
