Can we eliminate certificate revocation lists?
Abstract. We briefly consider certificate revocation lists (CRLs), and ask whether they could, and should, be eliminated, in favor of other mechanisms. In most cases, the answer seems to be “yes.” We suggest some possible replacement mechanisms.
What is a revocation server?
Having your computer check for certificate revocation on a server tells you if the certificate being used has been revoked by the certificate authority before it was set to expire.
What is Ocsp based revocation checking?
OCSP stands for Online Certificate Status Protocol and is used by Certificate Authorities to check the revocation status of an X. 509 digital certificate.
Why is a certificate revocation list ( CRL ) necessary?
The CRL is populated by a certificate authority (CA), another part of the PKI. Importantly, only the CA that issued the certificate has the power to revoke it and place it on the CRL. Why is a Certificate Revocation List Necessary? Without a CRL, there’s no way for the PKI to know whether a certificate has been revoked before its expiration.
Is there a list of all revoked certificates?
The first type is a full CRL; it contains all certificates revoked by the PKI. The second type is known as a delta CRL. It contains the list of all revoked certificates since the last time a full CRL was created.
Is the PKI publishing a certificate revocation list?
After definition, the PKI publishes CRLs and delta CRLs (if you choose to publish delta CRLs) for the computers that hold certificates that it has issued. Don’t worry too much about the variable names used in the list.
How to create a certificate revocation list distribution point ( CDP )?
The certificate revocation list distribution point (CDP) is a path represented as one or more attributes on every certificate issued by a PKI. This path, literal, share, lightweight directory access protocol (LDAP), and HTTP is clearly defined and uses variables to simplify the configuration.