Skip to main content
106 votes
Accepted

Should I revoke no longer used Let's Encrypt certificates before destroying them?

This is a subjective Cost vs Risk decision. We can't make it for you, but I can help you examine the factors involved. Cost To you: the effort of revoking the cert. If you have to do this manually, ...
Mike Ounsworth's user avatar
50 votes
Accepted

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

No. Revocation is an active event, not something that passively or automatically happens. Expiration is passive, though. An expired cert is no longer valid, so there's no need to stick it in a CRL or ...
CBHacking's user avatar
  • 49.1k
42 votes
Accepted

What's the point of certificates in SSL/TLS?

The signed CA response you envision is a certificate. Maybe not a classical X.509 certificate that we currently use, and maybe much more short-lived, but conceptually, it serves the exact same purpose ...
Ja1024's user avatar
  • 9,082
32 votes
Accepted

Who is responsible for revoking a certificate?

The answer by user2320464 is good, but I'd like to expand more. Summary: The certificate holder generally does not manage their own revocation information, because the whole point of revocation is to ...
Mike Ounsworth's user avatar
26 votes

Should I revoke no longer used Let's Encrypt certificates before destroying them?

Revocation is not necessary, from a security point of view, if the private key is not compromised. Unnecessary revocation will add a little load to the Let's Encrypt infrastructure but not much: ...
Tom's user avatar
  • 2,105
21 votes

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

You MUST check the expiration date first. You can do that locally, without creating a connection to the OCSP server and spending network resources at both your end and OCSP server's end. (And yes, I ...
fraxinus's user avatar
  • 3,568
18 votes

Should I revoke no longer used Let's Encrypt certificates before destroying them?

One possibility you overlooked is to generate a revocation but not publish until needed. It does put a slight load on your infrastructure but hides the takedown of the machine, and has a revocation ...
hildred's user avatar
  • 449
16 votes
Accepted

What is the exact difference between regular OCSP and OCSP stapling?

OCSP stapling is more efficient than regular OCSP and provides better privacy. The OCSP protocol is used to determine if a certificate is still valid or has been revoked. Say, you want to securely ...
Arminius's user avatar
  • 44.9k
11 votes
Accepted

Can a revoked certificate be re-instated?

The only option to unrevoke is when certificate is revoked with certificateHold reason (§5.3.1 in RFC5280). In all other cases the certificate (and the key) must be re-created.
Crypt32's user avatar
  • 6,391
9 votes

What's the point of certificates in SSL/TLS?

Think of the certificate as an official signed statement confirming that the public key belongs to a particular host. The CRL/OCSP systems are there so that you can confirm that the official signed ...
ARGYROU MINAS's user avatar
8 votes
Accepted

Is the use of regular OCSP or OCSP stapling a privacy risk?

The usage of OCSP Stapling is actualy the solution to "hide" the visitors from CA's eyes. And of course also for reducing the load on CA's OCSP responders. OCSP Stapling's principle is that the web ...
dave's user avatar
  • 305
7 votes
Accepted

Can we use one CA to revoke certificates generated by another CA?

No, not in practice. No, you can't. CA can revoke certificates it signed/issued only. There are a number of reasons for this choice. Although, RFC 5280 supports delegated revocation authorities (...
Crypt32's user avatar
  • 6,391
7 votes
Accepted

Is there a tool that reports on PKI health (CRL dates, expiry, etc)?

Just to add my one cent. I'm not aware of any such ready tools, however this feature was requested by a customer of mine some time ago. Eventually, I ended up with my own PowerShell solution for ...
Crypt32's user avatar
  • 6,391
7 votes
Accepted

How are root CA revocations handled?

As can be seen from Can a RootCA be revoked? there is no mechanism inside a PKI that a root CA gets removed. This means a mechanism outside the PKI is needed. This consists usually of an update of the ...
Steffen Ullrich's user avatar
7 votes
Accepted

What is the status of Certificate Transparency?

As of today (January 25, 2018), adoption of Certificate Transparency is not ubiquitous, but it is starting to gain momentum. Let's Encrypt logs all their certificates to CT logs, and several major CAs ...
Ajedi32's user avatar
  • 4,763
7 votes

Revoke Let's Encrypt CA for all devices in my organization?

Frame challenge! The issue is not with Let's Encrypt. The issue is that SSL has a few purposes, and you are ignoring one of the most important purposes for SSL (which Let's Encrypt is very important ...
Conor Mancone's user avatar
7 votes
Accepted

What capabilities does the Kazakhstan root CA have which other "trusted" CA's don't?

Would this be any different regarding capabilities to snoop and modify traffic? In case of Kazakhstan the government essentially urged their citizen to explicitly install this CA as trust into the ...
Steffen Ullrich's user avatar
7 votes
Accepted

Let's Encrypt certificate lifetime incident: is there any security risk?

The related task that they've opened explains why they do not plan to revoke certificates, and offers the following reasons for not doing so: "we do not believe that revoking certificates ...
gowenfawr's user avatar
  • 72.9k
6 votes

Is it secure to distribute Certificate Revocation Lists over HTTP?

HTTPS (or any TLS clients really) need to know the certificate revokation status before being able to trust that TLS connection. If the HTTPS connection used to fetch the CRL itself can't be trusted, ...
André Borie's user avatar
  • 12.8k
6 votes

Who is responsible for revoking a certificate?

Typically certificates are revoked by the person being issued the certificate. So if you were to purchase an SSL certificate and later found the private key was compromised, then you would revoke the ...
user2320464's user avatar
  • 1,862
6 votes
Accepted

Certificate and key abuse

Certificates in general Certificates are complicated, I don't blame you. By far, the most common use-case for certificates is for TLS websites where you need to submit a Certificate Signing Request (...
Mike Ounsworth's user avatar
6 votes

Does revoking a certificate result in revocation of its key?

There is no revocation of different parts of the certificate, i.e. a certificate is either revoked in full or not revoked at all. This also means that the certificate itself is revoked and not the key ...
Steffen Ullrich's user avatar
5 votes

difference between OCSP, CRL and CDP

The certificate revocation list (CRL) is a list of revoked certificates. It does not contain the certificate itself but mainly the serial number. It is signed directly or indirectly by the CA which ...
Steffen Ullrich's user avatar
5 votes
Accepted

Revoking signing keys: do they still work afterwards?

Can I revoke the signing subkey using the public key or do I need a copy of a private key as well? No, you always need the private primary key for all key management operations (subkeys, user IDs, ...
Jens Erat's user avatar
  • 24.6k
5 votes
Accepted

Why are short-lived certificates so rare?

It would be a huge operational cost in environments that don't have automated certificate management in place, which, in reality is the vast majority of the operational environments in the world today....
Xander's user avatar
  • 35.8k
5 votes
Accepted

Is OCSP Request Signing Necessary?

The best I can find is from a draft version 2 of X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP proposal, which later became RFC 2560. It states that: The ...
garethTheRed's user avatar
  • 1,594
5 votes

Are SSL certs auto-revoked if their Not-Valid-After date is reached without renewing?

Think about it like this. You go to the grocery store to buy milk. Would you check for recalls on milk to see if the milk is expired? No! You'd just check the expiration date. You know it's expired by ...
Captain Man's user avatar
4 votes

Who is responsible for revoking a certificate?

Since there is no way to cryptographically invalidate a certificate, a system must be used to publicly announce the revocation of a certificate. The Online Certificate Status Protocol (OCSP) is the ...
multithr3at3d's user avatar
4 votes

Certificate Revocation List (CRL) checking Best Practice

I would go with strict certificate revocation checking and reject certificate for which revocation information is not available. Why? If you are going to take actions (reject connection) when the ...
Crypt32's user avatar
  • 6,391

Only top scored, non community-wiki answers of a minimum length are eligible