Is it only controlled locally via hashsum or does the browser contact the webserver of the CA to verify the certificate?
|
feedback
|
|
The browser will have the public keys of various root authorities cached locally. If you use windows you occasionally see an update with 'root certificates' in the name, that's what it is. For a valid certificate the hierarchy can be traced all the way back to a valid root CA's public key, possibly via several resellers. It is possible to self sign a certificate and the first time you access a site with such a certificate you will receive a warning, and it will ask if you wish to continue and if you want to add the key to the list of trusted keys within the browser, this stops the warning coming up again - and you will be told if the key changes. | |||||||||
feedback
|
|
CRL or Certificate Revocation List is pretty important. A certificate issued might be valid according to a browser because the browser trusts the root CA (Certificate Authority) of the certificate. But the CA can always revoke a certificate it's issued. The only way a browser would know it's been revoked would be to check the CRL. Certificates usually come with an address of the CRL but by default, not all browsers care if the CRL list is available. I recall that at least one version of IE just sort of assumed that if it was a validly-issued cert, that's good enough if it can't contact the CRL properly. That is, if I can't see if you're revoked or not, I'll just assume not. | |||
|
feedback
|
