Collaborate Disseminate
In this page on Microsoft’s ADFS trust policy, it states:
most revocation checks exclude checking the root certificate
What is the reason for this? Why wouldn’t you want to check the whole certificate chain including th… Continue reading Why wouldn’t you check the revocation status of the root certificate?
Background: I’m designing a system that relies on certificates where I run my own root CA. As devices may get compromised, I need an option to revoke certificates. I’m currently evaluating whether to use CRLs or OCSP. Both do… Continue reading Recover from OCSP host compromise
I’m using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL.
However I need to configure crlDistributionPoints extension as described in the RFC 5280.
So is there a way to conf… Continue reading How do I use crlDistributionPoints with keytool?
I have a hierarchy of certificates which contains:
root-cert
server1-CA (issued from root-CA)
client1-cert (issued from server1-CA)
server2-CA (issued from root-CA)
client2-cert (issued from servier2-CA)
I need… Continue reading Can we use one CA to revoke certificates generated by another CA?
I have a hierarchy of certificates which contains:
root-cert
server1-CA (issued from root-CA)
client1-cert (issued from server1-CA)
server2-CA (issued from root-CA)
client2-cert (issued from servier2-CA)
I need to generate o… Continue reading Can we use one CA to revoke certificates generated by another CA?
A https website, which is not under my control, leads to an error message SEC_ERROR_REVOKED_CERTIFICATE in Firefox 51.
The CRL (url embedded in the certificate) does not distrust the sites certificate.
openssl s_client has no… Continue reading How can SEC_ERROR_REVOKED_CERTIFICATE in firefox be further examined?
Our firm wants to validate certificates using OCSP in its branch offices.
However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right thing to do imo.
So, because… Continue reading OCSP from branch office to central office
Are CRL lookups performed when receiving a S/MIME signed e-mail or onyl when it’s encrypted ?
Are CRL lookups performed when receiving a S/MIME signed e-mail or onyl when it’s encrypted ?
OpenSSL’s most recent update introduced a critical vulnerability in the crypto library, forcing an emergency update today. Continue reading OpenSSL Fixes Critical Bug Introduced by Latest Update