3
There is a fundamental rule here: in order to create a secure channel through an untrusted network, both ends of the channel must both possess some prior information that has been pre-shared through a trusted mechanism. The function of a Certificate Authority is to provide this shared trust without the two communicating entities needing any prior knowledge ...
2
Certificates can be revoked or suspended. I believe blocked refers to suspended in your case. Suspension is the term more commonly used when it comes to PKI management which is why you cannot find many references.
Suspension is temporary, it can be undone. Typically used when you lose your Government electronic ID card (containing qualified digital ...
2
But it got me wondering - does that actually protect me from attacks like homograph attacks or overlong encoding attacks?
No. A homograph attack would show you vοdafone.de but the first ο isn't really ο. From your browser point of view, the domain is valid, the certificate is valid, and issued for that domain. You would read the information on the ...
2
I think that OCSP validation comes before certificate chain validation.
it is not very correct. At first, certificate chain is built and validated. Once successfully validated, a revocation checking is performed. OCSP is checked during revocation checking process. Depending on TLS implementation, an OCSP response can be stapled in TLS handshake messages, so ...
1
Unfortunately it's simply impossible to determine when a request for a domain or certificate would be used to phish/scam people.
For example nissan.com is a perfectly valid domain even though it does not refer to the brand you are thinking of, but the owners could decide to sell the domain to some scammers. How can CAs and registrar decide which requests ...
1
One theory of certificates is "Renew often, and you won't get bitten by renewal."
A higher tempo of renewals means either humans are practiced in the steps required, or they've automated it (a la Let's Encrypt); either way the renewal is expected to go smoothly. By comparison, when renewal was multi-years, manual process, a lot of companies got ...
1
There is no specification in RFC5280 for blocking a certificate, but suspension and hold of certificate can be used to revoke the certificate temporarily:
As per RFC5280 certificate can be put on hold with CRL reason
as "certificateHold" :
If the certificate is valid and was listed on the referenced base CRL
or any subsequent CRL with reason code ...
1
This is intended behavior. Basically if you specify a static, unparameterized AuthorizedPrincipalFiles, then the same file is used for all users. If you want user-based control, you have to use the %u thing.
What happens under the hood becomes clearer if you look at the AuthorizesPrincipalsCommand. That one runs the specified command, passing the user as an ...
Only top voted, non community-wiki answers of a minimum length are eligible