A Certificate Revocation List (CRL) is a blacklist of revoked or compromised serial numbers of certificates. As a serial number has no direct relationship to a certificate and can be fabricated in a compromised CA, it is considered a weak blacklist.

learn more… | top users | synonyms

0
votes
0answers
24 views

Apache not checking crl for revoked certificates

I have the same problem as is described on question 23939112. I run my own CA authority. I created a certificate signed by my CA, with I can to login to web pages. Now, I'm testing revocation. I ...
2
votes
1answer
187 views

Certificate revocation check fails for non-domain guest in spite of accessible CRL

When we try to use certificates on computers that are not part of the domain, Windows complains that The revocation function was unable to check revocation because the revocation server was ...
12
votes
3answers
3k views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
2
votes
1answer
299 views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
5
votes
0answers
150 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
2
votes
1answer
2k views

Windows 2012 SSTP The revocation function was unable to check revocation because the revocation server was offline

In order to get rid of "Error 0×80092013: The revocation function was unable to check revocation because the revocation server was offline" you have to install base/delta CRLs on the client you want ...
3
votes
1answer
437 views

Microsoft CRL URL's

We have a number of Exchange servers without access to the internet. When updating Exchange, the fact that all .NET assemblies are signed means the installer needs to check Microsoft's CRL during the ...
1
vote
0answers
652 views

The revocation function was unable to check revocation for the certificate

I need to pass IIS certificate authentication on Windows Server 2012. The root cert haven't got any revocation lists but I'm getting exception: The revocation function was unable to check ...
0
votes
4answers
787 views

Can I find out what certificate revocation server an application is contacting?

I'm trying to install an application on a machine running Windows XP Pro. There are two different servers being contacted, both using the same wildcard certificate (GoDaddy). One via https, one ...
4
votes
1answer
2k views

nginx proxy + ssl +clr “400 bad request” error

Here's the situation - there's a trasnparent nginx proxy that handles SSL certificates and does it well until we decide to add a revocation list management, required for security reasons. This is when ...
1
vote
1answer
832 views

How do I manually publish a CRL for a certificate?

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
3
votes
1answer
932 views

How often is CRL refreshed, and how to force it to be?

I have a web service running under IIS 7 that requires an X509 client certificate. I know that the server that it rus on needs access to DigiCert.com in order to be able to get the CRL (Certificate ...
2
votes
1answer
996 views

How to reload Certificate Revocation List (CRL) in nginx?

I have set CRL file in nginx with ssl_crl directive: ssl_crl /mypath/crl.pem However, I noticed that adding or removing revoked certificates from crl.pem apply only when I restart or reload nginx ...
2
votes
1answer
5k views

Revocation status of DC can't be verified

A Domain Controller within my forest was working fine (as the story usually goes). Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message: The system ...
4
votes
2answers
334 views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
3
votes
1answer
1k views

RDP connection to domain server from non-domain client prompts “A revocation check could not be performed”

I've got about 30 Windows 2008 R2 servers as members of a domain, and am attempting to configure the certificates part correctly for remote desktop access to those servers. The catch is that the ...
1
vote
1answer
249 views

How to extract CRL location from x509 certificate using OpenSSL utility

I need to extract the crl location from a certificate authority so I can use that in verifying certificates. Is this possible using the openssl utility other than using the -text option and attempting ...
2
votes
3answers
3k views

How Can I Disable CRL Checks For A Windows 2008 App Using WinHTTP?

I've got a Windows 2008 server with an app that uses WinHTTP for SSL sessions. The server is isolated from the internet but still tries to connect to CRL distribution points, which leads to some ...
5
votes
3answers
1k views

Can Windows log CryptoAPI CRL timouts?

I suspect that the process of building the CRL cache may cause latency in some applications. We have several .NET applications that occasionally "act slow" with no CPU or disk access. I suspect that ...
4
votes
1answer
447 views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
1
vote
1answer
64 views

Windows Server 2003: Taking Root and Intermediate CA's offline causers faiure in Enterprise CA

I installed 3 CA's in lab environment: SA Root CA SA Intermediate CA Enterprise CA (also DC) The instructor recommends taking Root and Intermediate CA's offline once the Enterprise CA has been ...
1
vote
1answer
4k views

How to publish a CRL for an internal Windows certification authority?

I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
1
vote
1answer
1k views

How can we clear CRL cache in Windows Server 008 using certutil command?

I know we can clear the CRL Cache in Windows Server 2008 using the certification authority UI. However, I want to automate the process and therefore looking a way to do it from command line. Is it ...
2
votes
2answers
423 views

Maximum Size of CRL

Is there a CRL size that is beyond a practical limit? I did not find anything in the RFC. Is there any limit at all on the size of CRLs?
0
votes
1answer
511 views

SSTP SERVER without certificate check

Is it possible to make a SSTP server where clients don't need certificates? If I want to use linux or microtik routeros as a client, do I have to do something extra in the SSTP server (Windows Server ...
2
votes
1answer
696 views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
0
votes
1answer
192 views

Does IIS 6.0 Log CRL Checks?

I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
2
votes
1answer
8k views

Reset local Certificate Revocation List (CRL) manual

How can I reset local CRL (in OS local cash) in Windows OS (XP, Windows 7) manual? We need to reset local CRL because otherwise the OS will use local CRL until "next update" period. As described in ...
1
vote
1answer
177 views

Considerations for certificate revocation for intermittently isolated ad-hoc networks

I'm trying to decide on a certificate revocation strategy for a solution I'm designing (that will utilize Dogtag PKI, per customer request). The obvious choices seem to be using a CRL or using OCSP. ...
1
vote
1answer
142 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
1
vote
1answer
279 views

What should be the CRL publishing period for corporate environments?

I am trying to suggest a CRL publishing period for a Microsoft CA, the user certificates are going to be used for digital signature.There can be cases that a user certificate may be revoked. ...
0
votes
1answer
1k views

Openvpn intermediate CA CRL Question

I have created a CA and an intermediate CA using easy-rsa 2.0. On the Openvpn server I use the intermediate certificate export_ca (as per the easy-rsa spec). When I revoke a certificate on my ...
0
votes
1answer
3k views

Found CRL is expired - revoking all certificates until you get an updated CRL

My Apache-based application running on my VPS has recently stopped serving SSL transactions. I am getting errors like the following in the error_log: [Tue Aug 24 12:39:00 2010] [warn] Found CRL is ...
1
vote
1answer
391 views

CRL Check Questions

Windows XP | IE 7 Hi guys, From time to time, I'm seeing the following error come up: Revocation information for the security certificate for this site is not available. Do you want to ...