Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [crl]

Certificate Revocation List (CRL) is one of two common methods when using a public key infrastructure for maintaining access to servers in a network.

1
vote
1answer
191 views

Secure Design and CRL?

I was at my College Security Lesson, the professor said that Certificate Revocation Lists (CRLs) violate some of the Secure Design principles. Secure Design Principles: Fail-Safe Defaults Economy of ...
1
vote
1answer
196 views

how to avoid attack on Certificate Revocation List by the owner of the private key?

suppose A owns the private key, and its correspondent certificate locates in site of CA. B request for A's certificate from CA for verifying the signature sent to him/her. There is an attack ...
1
vote
1answer
345 views

How to sign a CRL file if I have offline keys?

I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-...
2
votes
1answer
91 views

Any case that can require to encrypt a certificate revocation list before distribution

As far as we know certificate revocation lists (CRLs) include public information so they do not have to be encrypted before distribution. Is there a case that can require to encrypt it before ...
2
votes
1answer
198 views

CRL number generation sequence: can I use a time stamp?

RFC 5280 states that the CRL number should monotonically increase. I have seen this common practice of incrementing the CRL number by 1, every time a new CRL is generated. But can I use a Unix (epoch ...
1
vote
1answer
590 views

I've got my private key compromised. How does CRL work?

How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL? Related: - How can ...