Contents
What happens if an intermediate certificate is revoked?
If an intermediate CA certificate is revoked then it becomes unusable. You cannot use it as part of a chain. So, if you want to validate one of the certificates which that CA has issued, then you will need to find another intermediate CA certificate, with the same CA name and key, and which is not revoked.
Certificate revocation is the act of invalidating a TLS/SSL before its scheduled expiration date. A certificate should be revoked immediately when its private key shows signs of being compromised. It should also be revoked when the domain for which it was issued is no longer operational.
How do I check my certificate of revocation OpenSSL?
Checking OCSP revocation using OpenSSL
- Obtain the certificate that you wish to check for revocation.
- Obtain the issuing certificate.
- Determine the URL of the OCSP responder.
- Submit an OCSP request and observe the response.
Why is a certificate revocation list ( CRL ) necessary?
The CRL is populated by a certificate authority (CA), another part of the PKI. Importantly, only the CA that issued the certificate has the power to revoke it and place it on the CRL. Why is a Certificate Revocation List Necessary? Without a CRL, there’s no way for the PKI to know whether a certificate has been revoked before its expiration.
When to revoke a certificate from a CA?
When a CA Administrator determines that a certificate should no longer be trusted, the CA Administrator can log onto a CA and revoke a certificate. In order to communicate that revocation the CA publishes a Certificate Revocation List (CRL). In order to make the CRL accessible the CRL is published to a repository.
Where can I find the AIA certificate revocation list?
AIA repositories support HTTP and LDAP protocol. Certificate Revocation List (CRL) contains the list of non-expired revoked certificates. It does not contain the revoked certificate itself, but the serial number of the revoked certificate. CRL Distribution Point (CDP) is the repository where CRL can be found and downloaded.
What are the different types of CRL certificates?
There are two types of CRLs: Base CRLs: A Base CRL is a CRL that contains all non-expired revoked certificates Delta CRLs: A Delta CRL is a CRL that contains all non-expired certificates that have been revoked since the last base CRL was published.