0
$\begingroup$

In contrast to private keys, public keys don't need to be stored on a secure place. But what if somebody changes a certificate with a public key to just another one? To ensure certificate authenticity, its validation chain can be verified up to the root CA certificate, which could be an unchangeable part of the software.

When a partner system updates my system with a new certificate (for whatever reason), I would, of course, check the chain validity before storing it on a proper place in the system. Now, should this kind of validation be carried out

  • everytime I use the certificate or
  • just before it is accepted as a new certificate?

I feel, that the first option would be the answer, but I want to avoid the overhead of validation against CA every time the certificate is used.

How would it be to store a validated certificate together with its hash (SHA-256) based on an individual system key, and to check only the hash when using the certificate?

|improve this question
$\endgroup$
  • 2
    $\begingroup$ Whether there is a Certificate Revocation List, or not, is critical. There are options in-between the extremes proposed. $\endgroup$ – fgrieu Jun 6 '17 at 10:18
  • 1
    $\begingroup$ It also depends on the context of the application / protocol and what the certificate is used for. For example, for online banking it's more critical to check the validity of the bank's certificate than if you use google via https. $\endgroup$ – tylo Jun 6 '17 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.