Collaborate Disseminate
The world’s leading free SSL provider announces that millions of certificates are being revoked due to a bug they discovered days ago — giving subscribers potentially only hours to respond…
The post Let’s Encrypt to Revoke 3 Millio… Continue reading Let’s Encrypt to Revoke 3 Million SSL Certificates on March 4
I have a signed JAR. How could I check if the corresponding code-signing certificate was revoked? Technically there seem to be the following options:
The Java TrustStore holds CRLs/revoked certificates.
The JarSigner checks… Continue reading Check CRLs of signed JARs
What purpose does it serve to have a CRL with nextUpdate set to +25 years?
A CRL issued by the root of an operating Certificate Authority
Certificate Revocation List (CRL):
Version 2 (0x1)
Signature Algorith… Continue reading Does it serve any purpose to have a CRL with the next update scheduled for 25 years in the future?
I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. “An end-to-end measurement of certificate revocation in the web’s PKI.” Proceedings of the 2015 Internet Measurement Conference. ACM, 2015 study and after… Continue reading How well do current browsers handle certificate revocation?
If I disagree with Let’s Encrypt’s cavalier attitude about SSL certificate issuance, and their indifference to their auto-generated certificates potentially being using for widespread criminal activities, how can I automatica… Continue reading Revoke Let’s Encrypt CA for all devices in my organization?
I’m looking for a bit more details on how the chain of ownership works when it comes to service providers requesting SSL certificates on behalf of another organization. The Who is responsible for revoking a certificate? post is helpful in… Continue reading Revoking a Certificate
If I request my identity certificate to be revoked for any reason other than key compromise, would the private key also be revoked in result?
Continue reading Does revoking a certificate result in revocation of its key?
We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
Based on RFC-6960 an OCSP Response should have the following as a minimum:
OCSPResponse ::= SEQUENCE {
responseStatus OCSPResponseStatus,
responseBytes [0] EXPLICIT ResponseBytes OPTIONAL }
Here respon… Continue reading OCSP responseStatus, is it really useful?
Planning a two tier ADCS PKI infrastructure as follows:
ORCA
____________|____________
| | |
SCA1 SCA2 SCA3
one.int two.int three.int
Where ORCA is an offlin… Continue reading ADCS two tier PKI