Questions tagged [crl]

A certificate revocation list (CRL) is a list of certificates that have been revoked and hence should not be trusted.

Filter by
Sorted by
Tagged with
1 vote
1 answer
2k views

is it necessary for cURL to check for CRL in Windows?

I'm trying to set up cURL to get data from remote server at any sitaution. I use --tlsv1.3 --tls13-ciphers TLS_CHACHA20_POLY1305_SHA256 --http2 to make it as secure as I can think of, using Windows 11....
user avatar
1 vote
1 answer
1k views

Firewall is blocking OCSP (Online Certificate Status Protocol) check

I have a certificate issued by lets encrypt and one of the certificate in the path has this information: [1]CRL Distribution Point Distribution Point Name: Full Name: URL=...
Ilya Chernomordik's user avatar
0 votes
1 answer
85 views

OpenSSL and connection time

Does anyone know about the search mechanism used in OpenSSL w.r.t verifying a serial number against a CRL file? I understand that in the case of Base-CRL approach, the file size will grow over time ...
Baranikumar Venkatesan's user avatar
0 votes
1 answer
484 views

Should root certificates have OCSP or CRL for it? [duplicate]

Should root certificates have OCSP or CRL for its own revocation status? So here is what I mean: Intermediate Cert -> http://example.com/root.crl SAN Cert -> https://example.com/intermediate.crl ...
Example person's user avatar
19 votes
5 answers
9k views

CRL over HTTPS: is it really a bad practice?

On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either it causes a chicken-and-egg problem when checking for ...
SquareRootOfTwentyThree's user avatar
1 vote
2 answers
530 views

Practical usage of CRL(Certificate Revocation List)

Does the CA need to mandatorily publish the new CRL file even though there are no new certificates that have been compromised since the last CRL published? If CA needs to publish the CRL's ...
Baranikumar Venkatesan's user avatar
0 votes
1 answer
1k views

Certificate Revocation with intermediate CAs - combine CRLs?

I use Nginx for client-side authentication. Only the SSL-certificates from the User CA should have access to the application. The CA hierarchy: Root CA | Intermediate CA | User CA So ...
Jessica Winter's user avatar
5 votes
0 answers
2k views

Openssl cms verify signature with timestamp and crl

I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
saurabh's user avatar
  • 768
1 vote
1 answer
2k views

Correct CRL and OSCP URIs along certificate chain

Merely because of private interest and usage in my own network, I'm creating a certificate chain (Root CA → Intermediate CA → Server cert) using openssl. I'd like the certificate chain to be ...
ahuemmer's user avatar
  • 143
0 votes
2 answers
190 views

Who/what maintains the CRL for a web server's client certs?

In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process. Is it really a ...
Thomas Stringer's user avatar
1 vote
0 answers
121 views

Mix OCSP stapling + CRL in a hierarchy of CAs

In an architecture with a root CA and a daughter CA, is it possible to combine OCSP stapling and CRL check? More precisely, is it possible for a client: to connect to an https server verify the ...
Beretta's user avatar
  • 35
10 votes
1 answer
3k views

How well do current browsers handle certificate revocation?

I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. "An end-to-end measurement of certificate revocation in the web's PKI." Proceedings of the 2015 Internet Measurement Conference. ...
Cobalt Scales's user avatar
1 vote
1 answer
317 views

What's the goal behind signing a CRL with an old certificate key?

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
Josefictuous's user avatar
0 votes
2 answers
150 views

Assuming that everyone always performs a revocation check, do we still need expiration time in each certificate? [duplicate]

I understand that each public key certificate includes an expiration time, and a CRL is issued periodically, listing all currently revoked certificates. However, in class we were told to think about ...
ashley's user avatar
  • 1
1 vote
0 answers
91 views

Revocation list for a custom solution

If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
SFlow's user avatar
  • 283
0 votes
1 answer
3k views

How to automate publication of CRL and CRT files to CDP and AIA location?

I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
Matty Brown's user avatar
4 votes
1 answer
311 views

Under what conditions is the Client trying "the next" CRL Distribution Point?

We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not ...
mnnhrt's user avatar
  • 41
0 votes
4 answers
435 views

Why are CRLs used instead of "valid certificates lists" and inner workings of CRLs

I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists). In my opinion this is kind of weird. A CA has to ...
Broco's user avatar
  • 128
14 votes
2 answers
10k views

Definitions for CRL Reasons

Is there any authoritative definition of the various reasons possible in a CRL file? Section 6.3.2(b) of RFC5280 lists a few: unspecified keyCompromise cACompromise affiliationChanged superseded ...
Bratchley's user avatar
  • 243
12 votes
2 answers
3k views

Are revoked certificates removed from CRLs after expiration? Why is this secure?

If a certificate is revoked before its expiry time and added to a CRL, is it removed from the CRL after the certificate validity period expires? RFC 5280 seems to imply this: A complete CRL lists all ...
malexmave's user avatar
  • 223
1 vote
0 answers
131 views

Why wouldn't you check the revocation status of the root certificate? [duplicate]

In this page on Microsoft's ADFS trust policy, it states: most revocation checks exclude checking the root certificate What is the reason for this? Why wouldn't you want to check the whole ...
Cocowalla's user avatar
  • 169
0 votes
2 answers
770 views

How do I use crlDistributionPoints with keytool?

I'm using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL. However I need to configure crlDistributionPoints extension as described in the RFC 5280. ...
Hakim's user avatar
  • 689
4 votes
1 answer
988 views

Can we use one CA to revoke certificates generated by another CA?

I have a hierarchy of certificates which contains: root-cert server1-CA (issued from root-CA) client1-cert (issued from server1-CA) server2-CA (issued from root-CA) client2-cert (issued from ...
Hakim's user avatar
  • 689
1 vote
1 answer
5k views

How can SEC_ERROR_REVOKED_CERTIFICATE in firefox be further examined?

A https website, which is not under my control, leads to an error message SEC_ERROR_REVOKED_CERTIFICATE in Firefox 51. The CRL (url embedded in the certificate) does not distrust the sites certificate....
user avatar
3 votes
1 answer
587 views

OCSP Responder certificate - CRL distribution points and AIA OCSP URI

I am building OCSP responder and I need to issue OCSP Signer certificate from CA that will be used to sign OCSP responses. In a definition of certificate profile for OCSP Signer certificate, should I ...
user1563721's user avatar
  • 1,119
0 votes
1 answer
714 views

openssl crl "Error getting CRL issuer certificate" reasons

CRL file A - http://pastebin.com/ZXGk9p0X CA file B in directory "dir1" http://pastebin.com/05PKGCjH openssl crl -in A -CApath dir1 gives the error Error getting CRL issuer certificate I had ...
user93353's user avatar
  • 2,022
4 votes
1 answer
2k views

"openssl crl" verify gives "Error getting CRL issuer certificate"

File A - This is my CRL File - http://pastebin.com/yvstfPTD File B - It's signed by this cert - http://pastebin.com/T1pXZSat File C - The CRL signing cert has been issued by this CA http://pastebin....
user93353's user avatar
  • 2,022
1 vote
1 answer
147 views

HTTP methods to be supported for CRL downloading

I was not able to find anywhere in the RFCs which HTTP methods must be supported by the conformant CAs in order to allow users to download CRL. What are the mandatory HTTP methods (GET, HEAD, ...) ...
tysonite's user avatar
  • 469
0 votes
1 answer
140 views

OCSP from branch office to central office

Our firm wants to validate certificates using OCSP in its branch offices. However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right ...
Ti.'s user avatar
  • 1
3 votes
2 answers
861 views

S/MIME signed e-mail, CRL ?

Are CRL lookups performed when receiving a S/MIME signed e-mail or onyl when it's encrypted ?
cyzczy's user avatar
  • 1,558
2 votes
1 answer
2k views

Why not set Root CA CRL for Sub-CA to be really long?

I am designing a two-tier AD-CS PKI and when it comes to the Root CA I am struggling to understand the validity period of the CRL which is used to validate the sub-CAs by end entitites. Documentation ...
slinkoff's user avatar
1 vote
0 answers
6k views

(net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION)

why do I get There are issues with the site's certificate chain (net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION) in chrome when accessing an https page? according to https://bugs.chromium.org/p/chromium/...
cyzczy's user avatar
  • 1,558
0 votes
1 answer
437 views

Should updated CRLs be published even if no new certs have been revoked?

Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in default_crl_days when the certificate was generated? ...
André Borie's user avatar
  • 12.8k
1 vote
1 answer
558 views

Revocation of intermediate trusted CA

My question is related to the revocation of intermediate CA. Suppose I have a device that performs the revocation checks on the whole chain and assigns the intermediate CA's a trusted level.Now ...
H4X's user avatar
  • 161
5 votes
1 answer
4k views

Does Firefox use OCSP?

And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
leeand00's user avatar
  • 1,399
0 votes
1 answer
176 views

Can a CRL file contain multiple full stops in its name?

Will a CRL file name such as fred.freddy.domain.crl work for a Certificate Revocation List URL? I cannot find any documentation to state that it will not work. Closest that I have found is a ...
Jamie's user avatar
  • 3
8 votes
3 answers
3k views

X509 CRL suspended certificates and openssl ca comand

In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it. ...
Fausto Carvalho Marques Silva's user avatar
4 votes
0 answers
502 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
homer321's user avatar
28 votes
3 answers
3k views

Does any technology prevent a CA unilaterally revoking a certificate?

As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP). In an increasingly TLS world, what current technology stops a CA shutting ...
Phil Lello's user avatar
  • 1,122
1 vote
1 answer
2k views

TinyCA missing CRL information in root and leaf certificates

I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem And I have exported the CRL to that location, and I ...
TSG's user avatar
  • 159
2 votes
1 answer
97 views

Questions regarding CRLs (producedAt and not modified)

I have two questions regarding the safety of requesting CRLs. My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
SWdV's user avatar
  • 189
3 votes
1 answer
1k views

TLS - How to know a CRL URL is not changed

If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
SWdV's user avatar
  • 189
5 votes
1 answer
3k views

Which CRL should an intermediate CA crlDistributionPoint contain?

Given a root certificate authority (CA) and an intermediate CA signed by the root: Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the intermediate ...
Brad303's user avatar
  • 153
2 votes
1 answer
2k views

How to revoke certificates, or generate CRL files with Keytool

I didn't find how to use java keytool to revoke certificates or generate CRL files. Is it possible to do that with keytool? If no, how to do it with openssl ?
Hakim's user avatar
  • 689
1 vote
1 answer
609 views

CRL verification with renewed CA

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed. Suppose I have the following setup: ...
user1563721's user avatar
  • 1,119
3 votes
1 answer
711 views

RemoveFromCRL and DeltaCRL

I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason. At the start, PKI has revoked the certificate with certificateHold reason. And create next CRL: Last Update: May ...
YBW's user avatar
  • 133
11 votes
1 answer
4k views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
efkan's user avatar
  • 342
4 votes
1 answer
94 views

Mail Signing Certificate – What are the impacts when revocated?

Suppose I open a signed mail on 1st January 2000, signature is OK. What about this two cases : 1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
crypto-learner's user avatar
0 votes
2 answers
751 views

Check signature when next CRL will be published after end of validity of certificate

My situation looks like this: I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revoked. But what if certificate ...
Mumbar's user avatar
  • 5
25 votes
3 answers
12k views

Is publishing CRLs over HTTP a potential vulnerability?

I noticed that at least one major CA (Comodo) publishes their CRL over HTTP rather than HTTPS. This seems to me to be somewhat of a vulnerability, as an attacker could hijack the HTTP connection that ...
user's user avatar
  • 7,755