Collaborate Disseminate
What happens when a hacker gets an SSL certificate’s private key? The CA revokes it. But how does the browser know whether a website’s certificate has been revoked? OCSP is one way your web client can check…
The post Everything You N… Continue reading Everything You Need to Know About OCSP, OCSP Stapling & OCSP Must-Staple
Merely because of private interest and usage in my own network, I’m creating a certificate chain (Root CA → Intermediate CA → Server cert) using openssl. I’d like the certificate chain to be traceable and also being able to revok… Continue reading Correct CRL and OSCP URIs along certificate chain
I have an architecture with a root ca and a sub ca like this:
root ca > sub ca > server <———-> external client
The root ca delivers a certificate for the sub ca.
The sub ca delivers a certificate for the internal server.
So I h… Continue reading Check the certification chain with ocsp
I have a root certificate authority, an sub CA and an server.
The root ca delivers a certificate for the sub CA.
The sub CA delivers a certificate for the server.
I want to check all the certification chain, from the server to the root … Continue reading Certificate checking with OCSP and root CA not trusted
I use the C libcurl library.
I need to do OCSP stapling combined with mutual authentication. For that, I’ll take model on the below exemples. However, I need the private key of my client certificate to be stored in the TPM chip. Do you kn… Continue reading libcurl: how to use TPM private key for mutual SSL authentication
I’m implementing an OCSP server to answer OCSP requests for my custom CA.
I already implemented the invalidation of leaves certificates, with the intermediate CA certificate signing the OCSP response, and it seems to be working.
However, I… Continue reading OCSP invalidation of intermediate CA using OCSP_SIGNING
As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?
Continue reading How does an offline Root CA sign OCSP Response?
I would like to set up OCSP multi stapling and I can not find a lot of documentation on it, or in any case, recent information.
I have a root certificate authority (CA) and a daughter CA below. Both work with Freeipa (and Fr… Continue reading OCSP multi stapling : how to enable it? Simple stapling is OK
In an architecture with a root CA and a daughter CA, is it possible to combine OCSP stapling and CRL check?
More precisely, is it possible for a client:
to connect to an https server
verify the validity of the server’s ce… Continue reading Mix OCSP stapling + CRL in a hierarchy of CAs
I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. “An end-to-end measurement of certificate revocation in the web’s PKI.” Proceedings of the 2015 Internet Measurement Conference. ACM, 2015 study and after… Continue reading How well do current browsers handle certificate revocation?