107
votes
Accepted
Should I revoke no longer used Let's Encrypt certificates before destroying them?
This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved.
Cost
To you: the effort of revoking the cert. If you have to do this manually, ...
- 58.2k
50
votes
Accepted
Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?
No. Revocation is an active event, not something that passively or automatically happens. Expiration is passive, though. An expired cert is no longer valid, so there's no need to stick it in a CRL or ...
- 43k
32
votes
Accepted
Who is responsible for revoking a certificate?
The answer by user2320464 is good, but I'd like to expand more.
Summary: The certificate holder generally does not manage their own revocation information, because the whole point of revocation is to ...
- 58.2k
26
votes
Should I revoke no longer used Let's Encrypt certificates before destroying them?
Revocation is not necessary, from a security point of view, if the private key is not compromised.
Unnecessary revocation will add a little load to the Let's Encrypt infrastructure but not much: ...
- 2,085
24
votes
Accepted
Why isn't there a certificate revocation request standard?
There is a standard for that, and, more generally, for all communications with a PKI. It is called Certificate Management Protocol (CMP). Revocation requests are specified in section 5.3.9.
Now, ...
- 323k
21
votes
Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?
You MUST check the expiration date first. You can do that locally, without creating a connection to the OCSP server and spending network resources at both your end and OCSP server's end. (And yes, I ...
- 3,468
18
votes
Should I revoke no longer used Let's Encrypt certificates before destroying them?
One possibility you overlooked is to generate a revocation but not publish until needed. It does put a slight load on your infrastructure but hides the takedown of the machine, and has a revocation ...
- 449
16
votes
Accepted
Should I use a Certificate Revocation List?
First of, CRL do not cover root CA. By definition, a root CA is a root: it has no issuer except itself. A CRL conveys revocation information, which is a way for a certificate issuer to announce that a ...
- 323k
15
votes
Accepted
Has the leaked D-Link Windows signing key been revoked?
Update 2016-12-28: I finally decided to check the CRL as well. And it turns out: Yup, certificate is in there still. Even long after its original expiration date.
$ openssl x509 -in 0.dlink.cer -...
- 17.9k
15
votes
Accepted
What is the exact difference between regular OCSP and OCSP stapling?
OCSP stapling is more efficient than regular OCSP and provides better privacy.
The OCSP protocol is used to determine if a certificate is still valid or has been revoked. Say, you want to securely ...
- 44.3k
13
votes
Accepted
What does "revoking" a key actually do?
Think of revoking a key as a comment added to the key file. This comment, if present, will tell others users of your key (someone that send you encrypted gpg emails for exemple) that the key have been ...
- 573
11
votes
Accepted
Can a revoked certificate be re-instated?
The only option to unrevoke is when certificate is revoked with certificateHold reason (§5.3.1 in RFC5280). In all other cases the certificate (and the key) must be re-created.
- 5,916
9
votes
SSL certificate renewal and downtime due to revocation
Renewing an SSL certificate is the functional equivalent of generating a new certificate; it is not a revocation, and the 'old' certificate will continue to be accepted as valid, assuming it has not ...
- 1,962
8
votes
How to trust a CA to sign a CRL but not a cert?
If the entity is supposed to sign CRL but not certificates, then it is not a CA -- it is a CRL issuer. It is often called an indirect CRL issuer because, by definition, it is distinct from the CA that ...
- 170k
8
votes
Accepted
Is the use of regular OCSP or OCSP stapling a privacy risk?
The usage of OCSP Stapling is actualy the solution to "hide" the visitors from CA's eyes. And of course also for reducing the load on CA's OCSP responders.
OCSP Stapling's principle is that the web ...
- 305
7
votes
Accepted
Understanding how does certificate validation work
Validation is about making sure that a certificate is genuine. The goal is to know whether the public key you see is really owned by the server you intend to talk to. This validation entails a lot of ...
- 170k
7
votes
Accepted
Is there a tool that reports on PKI health (CRL dates, expiry, etc)?
Just to add my one cent.
I'm not aware of any such ready tools, however this feature was requested by a customer of mine some time ago. Eventually, I ended up with my own PowerShell solution for ...
- 5,916
7
votes
Accepted
How are root CA revocations handled?
As can be seen from Can a RootCA be revoked? there is no mechanism inside a PKI that a root CA gets removed. This means a mechanism outside the PKI is needed. This consists usually of an update of the ...
- 191k
7
votes
Accepted
What is the status of Certificate Transparency?
As of today (January 25, 2018), adoption of Certificate Transparency is not ubiquitous, but it is starting to gain momentum. Let's Encrypt logs all their certificates to CT logs, and several major CAs ...
- 4,693
7
votes
Revoke Let's Encrypt CA for all devices in my organization?
Frame challenge!
The issue is not with Let's Encrypt. The issue is that SSL has a few purposes, and you are ignoring one of the most important purposes for SSL (which Let's Encrypt is very important ...
- 30.4k
7
votes
Accepted
What capabilities does the Kazakhstan root CA have which other "trusted" CA's don't?
Would this be any different regarding capabilities to snoop and modify traffic?
In case of Kazakhstan the government essentially urged their citizen to explicitly install this CA as trust into the ...
- 191k
7
votes
Accepted
Let's Encrypt certificate lifetime incident: is there any security risk?
The related task that they've opened explains why they do not plan to revoke certificates, and offers the following reasons for not doing so:
"we do not believe that revoking certificates ...
- 72.4k
6
votes
Accepted
Why do so many browsers show sites with revoked certificates?
Checking for revocation is easy. But deciding what to do upon failure is not.
On the site you linked Steve Gibson writes:
Much of the certificate revocation system is
badly broken and doesn't ...
- 17.9k
6
votes
What does "revoking" a key actually do?
Gnupg is open source (yeah!) and hence it can be looked up what happens.
When you create a revocation certificate for a key i.e. via
`gpg --gen-revoke name"
it internally moves through the following ...
- 1,432
6
votes
Who is responsible for revoking a certificate?
Typically certificates are revoked by the person being issued the certificate. So if you were to purchase an SSL certificate and later found the private key was compromised, then you would revoke the ...
- 1,832
6
votes
Accepted
Can we use one CA to revoke certificates generated by another CA?
No, not in pratice.
No, you can't. CA can revoke certificates it signed/issued only. There is a number of reasons of this choice. Although, RFC 5280 supports delegated revocation authorities (through ...
- 5,916
6
votes
Accepted
Certificate and key abuse
Certificates in general
Certificates are complicated, I don't blame you. By far, the most common use-case for certificates is for TLS websites where you need to submit a Certificate Signing Request (...
- 58.2k
6
votes
Does revoking a certificate result in revocation of its key?
There is no revocation of different parts of the certificate, i.e. a certificate is either revoked in full or not revoked at all. This also means that the certificate itself is revoked and not the key ...
- 191k
5
votes
Accepted
Why are short-lived certificates so rare?
It would be a huge operational cost in environments that don't have automated certificate management in place, which, in reality is the vast majority of the operational environments in the world today....
- 35.6k
Only top scored, non community-wiki answers of a minimum length are eligible