Questions tagged [crl]
A certificate revocation list (CRL) is a list of certificates that have been revoked and hence should not be trusted.
50
questions
16
votes
4answers
3k views
CRL over HTTPS: is it really a bad practice?
On the Internet, I can find several statements done over the years claiming that serving a X.509 CRL over HTTPS is a bad practice because either
it causes a chicken-and-egg problem when checking for ...
2
votes
2answers
59 views
Practical usage of CRL(Certificate Revocation List)
Does the CA need to mandatorily publish the new CRL file even though there are no new certificates that have been compromised since the last CRL published?
If CA needs to publish the CRL's ...
0
votes
0answers
99 views
Certificate Revocation with intermediate CAs - combine CRLs?
I use Nginx for client-side authentication.
Only the SSL-certificates from the User CA should have access to the application.
The CA hierarchy:
Root CA
|
Intermediate CA
|
User CA
So ...
2
votes
0answers
601 views
Openssl cms verify signature with timestamp and crl
I've used OpenSSL cms to sign the data and generate a detached signature. As per my requirements, I need to timestamp the signature as well, so that if the certificate expired, verification of ...
1
vote
1answer
319 views
Correct CRL and OSCP URIs along certificate chain
Merely because of private interest and usage in my own network, I'm creating a certificate chain (Root CA → Intermediate CA → Server cert) using openssl. I'd like the certificate chain to be ...
0
votes
2answers
83 views
Who/what maintains the CRL for a web server's client certs?
In the instance of a web server that requires client certificates to log in, what exactly is creating and updating the CRL? From all of the examples I see, it is a manual process.
Is it really a ...
1
vote
0answers
55 views
Mix OCSP stapling + CRL in a hierarchy of CAs
In an architecture with a root CA and a daughter CA, is it possible to combine OCSP stapling and CRL check?
More precisely, is it possible for a client:
to connect to an https server
verify the ...
9
votes
1answer
709 views
How well do current browsers handle certificate revocation?
I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. "An end-to-end measurement of certificate revocation in the web's PKI." Proceedings of the 2015 Internet Measurement Conference. ...
1
vote
1answer
121 views
What's the goal behind signing a CRL with an old certificate key?
I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
0
votes
2answers
99 views
Assuming that everyone always performs a revocation check, do we still need expiration time in each certificate? [duplicate]
I understand that each public key certificate includes an expiration time, and a CRL is issued periodically, listing all currently revoked certificates. However, in class we were told to think about ...
1
vote
0answers
42 views
Revocation list for a custom solution
If I have a network of machines inside a company that use certificates for various services. All of these services and machines are internal and never have to deal with public facing technologies or ...
0
votes
1answer
1k views
How to automate publication of CRL and CRT files to CDP and AIA location?
I'm setting up Two-Tier PKI for the first time in our Windows Server 2012 R2 environment and I've read several tutorials on setting this up. Some of the methodology is very different, but I've chosen ...
4
votes
1answer
178 views
Under what conditions is the Client trying “the next” CRL Distribution Point?
We've got a scenario where the CRL is distributed to 2 different Locations.
One ist accessable from a private network and not from the internet.
The other one is asseccable from the internet but not ...
0
votes
4answers
190 views
Why are CRLs used instead of “valid certificates lists” and inner workings of CRLs
I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists).
In my opinion this is kind of weird. A CA has to ...
12
votes
2answers
5k views
Definitions for CRL Reasons
Is there any authoritative definition of the various reasons possible in a CRL file? Section 6.3.2(b) of RFC5280 lists a few:
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
...
10
votes
1answer
2k views
Are revoked certificates removed from CRLs after expiration? Why is this secure?
If a certificate is revoked before its expiry time and added to a CRL, is it removed from the CRL after the certificate validity period expires? RFC 5280 seems to imply this:
A complete CRL lists ...
1
vote
0answers
81 views
Why wouldn't you check the revocation status of the root certificate? [duplicate]
In this page on Microsoft's ADFS trust policy, it states:
most revocation checks exclude checking the root certificate
What is the reason for this? Why wouldn't you want to check the whole ...
0
votes
2answers
521 views
How do I use crlDistributionPoints with keytool?
I'm using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL.
However I need to configure crlDistributionPoints extension as described in the RFC 5280.
...
2
votes
1answer
610 views
Can we use one CA to revoke certificates generated by another CA?
I have a hierarchy of certificates which contains:
root-cert
server1-CA (issued from root-CA)
client1-cert (issued from server1-CA)
server2-CA (issued from root-CA)
client2-cert (issued from ...
1
vote
1answer
5k views
How can SEC_ERROR_REVOKED_CERTIFICATE in firefox be further examined?
A https website, which is not under my control, leads to an error message SEC_ERROR_REVOKED_CERTIFICATE in Firefox 51.
The CRL (url embedded in the certificate) does not distrust the sites certificate....
3
votes
1answer
408 views
OCSP Responder certificate - CRL distribution points and AIA OCSP URI
I am building OCSP responder and I need to issue OCSP Signer certificate from CA that will be used to sign OCSP responses.
In a definition of certificate profile for OCSP Signer certificate, should I ...
0
votes
1answer
405 views
openssl crl “Error getting CRL issuer certificate” reasons
CRL file A - http://pastebin.com/ZXGk9p0X
CA file B in directory "dir1" http://pastebin.com/05PKGCjH
openssl crl -in A -CApath dir1
gives the error
Error getting CRL issuer certificate
I had ...
2
votes
1answer
897 views
“openssl crl” verify gives “Error getting CRL issuer certificate”
File A - This is my CRL File - http://pastebin.com/yvstfPTD
File B - It's signed by this cert - http://pastebin.com/T1pXZSat
File C - The CRL signing cert has been issued by this CA http://pastebin....
1
vote
1answer
51 views
HTTP methods to be supported for CRL downloading
I was not able to find anywhere in the RFCs which HTTP methods must be supported by the conformant CAs in order to allow users to download CRL.
What are the mandatory HTTP methods (GET, HEAD, ...) ...
0
votes
1answer
97 views
OCSP from branch office to central office
Our firm wants to validate certificates using OCSP in its branch offices.
However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right ...
3
votes
2answers
527 views
S/MIME signed e-mail, CRL ?
Are CRL lookups performed when receiving a S/MIME signed e-mail or onyl when it's encrypted ?
2
votes
1answer
1k views
Why not set Root CA CRL for Sub-CA to be really long?
I am designing a two-tier AD-CS PKI and when it comes to the Root CA I am struggling to understand the validity period of the CRL which is used to validate the sub-CAs by end entitites.
Documentation ...
0
votes
0answers
3k views
(net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION)
why do I get There are issues with the site's certificate chain (net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION) in chrome when accessing an https page?
according to https://bugs.chromium.org/p/chromium/...
0
votes
1answer
199 views
Should updated CRLs be published even if no new certs have been revoked?
Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in default_crl_days when the certificate was generated?
...
1
vote
1answer
384 views
Revocation of intermediate trusted CA
My question is related to the revocation of intermediate CA. Suppose I have a device that performs the revocation checks on the whole chain and assigns the intermediate CA's a trusted level.Now ...
5
votes
1answer
3k views
Does Firefox use OCSP?
And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
0
votes
1answer
93 views
Can a CRL file contain multiple full stops in its name?
Will a CRL file name such as fred.freddy.domain.crl work for a Certificate Revocation List URL? I cannot find any documentation to state that it will not work.
Closest that I have found is a ...
6
votes
3answers
2k views
X509 CRL suspended certificates and openssl ca comand
In CRL X509 format we have "Hold Instruction code" for a list of suspended certificates. I know that "its use is strongly deprecated for the Internet PKI", but in my own private CA, I want to use it.
...
4
votes
0answers
410 views
Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?
I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
28
votes
3answers
3k views
Does any technology prevent a CA unilaterally revoking a certificate?
As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP).
In an increasingly TLS world, what current technology stops a CA shutting ...
1
vote
1answer
2k views
TinyCA missing CRL information in root and leaf certificates
I setup a new CA using TinyCA. When creating the CA i used an internal host name for the crl url exactly as follows: http://myserver.com/crl.pem
And I have exported the CRL to that location, and I ...
2
votes
1answer
49 views
Questions regarding CRLs (producedAt and not modified)
I have two questions regarding the safety of requesting CRLs.
My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
3
votes
1answer
893 views
TLS - How to know a CRL URL is not changed
If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be ...
3
votes
1answer
2k views
Which CRL should an intermediate CA crlDistributionPoint contain?
Given a root certificate authority (CA) and an intermediate CA signed by the root:
Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the intermediate ...
2
votes
1answer
1k views
How to revoke certificates, or generate CRL files with Keytool
I didn't find how to use java keytool to revoke certificates or generate CRL files.
Is it possible to do that with keytool?
If no, how to do it with openssl ?
1
vote
1answer
404 views
CRL verification with renewed CA
I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed.
Suppose I have the following setup:
...
3
votes
1answer
488 views
RemoveFromCRL and DeltaCRL
I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason.
At the start, PKI has revoked the certificate with certificateHold reason.
And create next CRL:
Last Update: May ...
11
votes
1answer
3k views
Should I use a Certificate Revocation List?
I've been trying to provide security to my API.
I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication.
I'm wondering, should I use ...
4
votes
1answer
56 views
Mail Signing Certificate – What are the impacts when revocated?
Suppose I open a signed mail on 1st January 2000, signature is OK.
What about this two cases :
1) If next CRL is to be published one week later, I found it strange that it is “probably” valid until ...
0
votes
2answers
498 views
Check signature when next CRL will be published after end of validity of certificate
My situation looks like this:
I have to verify signature on document. For this I will wait when next CRL will be published to check that involved certificate was not revoked. But what if certificate ...
22
votes
3answers
9k views
Is publishing CRLs over HTTP a potential vulnerability?
I noticed that at least one major CA (Comodo) publishes their CRL over HTTP rather than HTTPS.
This seems to me to be somewhat of a vulnerability, as an attacker could hijack the HTTP connection that ...
2
votes
2answers
267 views
Should expired compromised certificates be taken care of if the time is always correct?
I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration.
In my case, the root certificate of CA is ...
0
votes
1answer
12k views
Verify Certificate is revoked by CRL
I set up a CA and signed some cert request.
I revoke them by:
openssl ca -config config.cnf -revoke cert.pem
I update CRL by:
openssl ca -config config.cnf -gencrl -out crl/crl.pem
index.txt ...
2
votes
1answer
149 views
How does checking CRLs make sites less safe?
With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
4
votes
3answers
2k views
How are CRLsets more secure?
Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
