Questions tagged [crl]
Certificate Revocation List (CRL) is one of two common methods when using a public key infrastructure for maintaining access to servers in a network.
9
questions
1
vote
1answer
66 views
What does (06) in “CRL Signing (06)” mean?
In "Certificate details -> key usage -> CRL Signing (06)", what does "(06)" in "CRL Signing (06)" mean?
1
vote
1answer
47 views
How are certificate status obtained on browsers?
There are two ways of checking the status of a digital certificate:-
Offline Authentication (CRL)
Online Authentication (OCSP, SCVP)
Several browsers (like Mozilla Firefox) have given up the use of ...
0
votes
2answers
69 views
How are CRL implemented?
The source from where I learn states:-
CRL (Certificate Revocation List) is the primary means of checking status of certificates offline.
But I can't seem to understand how is it possible for a ...
1
vote
1answer
196 views
Secure Design and CRL?
I was at my College Security Lesson, the professor said that Certificate Revocation Lists (CRLs) violate some of the Secure Design principles.
Secure Design Principles:
Fail-Safe Defaults
Economy of ...
1
vote
1answer
253 views
how to avoid attack on Certificate Revocation List by the owner of the private key?
suppose A owns the private key, and its correspondent certificate locates in site of CA.
B request for A's certificate from CA for verifying the signature sent to him/her.
There is an attack ...
1
vote
1answer
493 views
How to sign a CRL file if I have offline keys?
I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-...
2
votes
1answer
114 views
Any case that can require to encrypt a certificate revocation list before distribution
As far as we know certificate revocation lists (CRLs) include public information so they do not have to be encrypted before distribution.
Is there a case that can require to encrypt it before ...
2
votes
1answer
245 views
CRL number generation sequence: can I use a time stamp?
RFC 5280 states that the CRL number should monotonically increase. I have seen this common practice of incrementing the CRL number by 1, every time a new CRL is generated. But can I use a Unix (epoch ...
1
vote
1answer
646 views
I've got my private key compromised. How does CRL work?
How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL?
Related:
- How can ...
