A Certificate Revocation List (CRL) is a blacklist of revoked or compromised serial numbers of certificates. As a serial number has no direct relationship to a certificate and can be fabricated in a compromised CA, it is considered a weak blacklist.

learn more… | top users | synonyms

11
votes
3answers
746 views

How do I check if my SSL certificates have been revoked

The recent discovery of the heartbleed vulnerability has prompted certificate authorities to re-issue certificates. I have two certificates that were generated before the heartbleed vulnerability ...
4
votes
1answer
363 views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
4
votes
2answers
248 views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
4
votes
1answer
1k views

nginx proxy + ssl +clr “400 bad request” error

Here's the situation - there's a trasnparent nginx proxy that handles SSL certificates and does it well until we decide to add a revocation list management, required for security reasons. This is when ...
3
votes
3answers
888 views

Can Windows log CryptoAPI CRL timouts?

I suspect that the process of building the CRL cache may cause latency in some applications. We have several .NET applications that occasionally "act slow" with no CPU or disk access. I suspect that ...
3
votes
1answer
227 views

Microsoft CRL URL's

We have a number of Exchange servers without access to the internet. When updating Exchange, the fact that all .NET assemblies are signed means the installer needs to check Microsoft's CRL during the ...
3
votes
1answer
661 views

How often is CRL refreshed, and how to force it to be?

I have a web service running under IIS 7 that requires an X509 client certificate. I know that the server that it rus on needs access to DigiCert.com in order to be able to get the CRL (Certificate ...
3
votes
1answer
866 views

RDP connection to domain server from non-domain client prompts “A revocation check could not be performed”

I've got about 30 Windows 2008 R2 servers as members of a domain, and am attempting to configure the certificates part correctly for remote desktop access to those servers. The catch is that the ...
3
votes
0answers
89 views

How to use Chrome's CRL sets (or some master CRL list) as a CRL file?

I am looking for a master CRL list. The closest thing I have found is the Chromium project's CRLSets. I used crlset-tools to get the crlset (crlset fetch > crl-set) and then dumped the serial ...
2
votes
2answers
309 views

Maximum Size of CRL

Is there a CRL size that is beyond a practical limit? I did not find anything in the RFC. Is there any limit at all on the size of CRLs?
2
votes
1answer
4k views

Revocation status of DC can't be verified

A Domain Controller within my forest was working fine (as the story usually goes). Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message: The system ...
2
votes
1answer
705 views

How to reload Certificate Revocation List (CRL) in nginx?

I have set CRL file in nginx with ssl_crl directive: ssl_crl /mypath/crl.pem However, I noticed that adding or removing revoked certificates from crl.pem apply only when I restart or reload nginx ...
2
votes
1answer
571 views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
2
votes
1answer
6k views

Reset local Certificate Revocation List (CRL) manual

How can I reset local CRL (in OS local cash) in Windows OS (XP, Windows 7) manual? We need to reset local CRL because otherwise the OS will use local CRL until "next update" period. As described in ...
2
votes
1answer
790 views

Windows 2012 SSTP The revocation function was unable to check revocation because the revocation server was offline

In order to get rid of "Error 0×80092013: The revocation function was unable to check revocation because the revocation server was offline" you have to install base/delta CRLs on the client you want ...
2
votes
2answers
3k views

How Can I Disable CRL Checks For A Windows 2008 App Using WinHTTP?

I've got a Windows 2008 server with an app that uses WinHTTP for SSL sessions. The server is isolated from the internet but still tries to connect to CRL distribution points, which leads to some ...
2
votes
1answer
158 views

How to check multiple CRL lists with nginx client authentication?

I have a custom easyrsa setup with a root and three CAs signed by the root. (Three different sub-cas depending on the user type), like this: RootCA +----- AdminUserCA +----- EmployeeCA +----- ...
1
vote
1answer
4k views

How to publish a CRL for an internal Windows certification authority?

I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
1
vote
1answer
131 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
1
vote
1answer
53 views

Windows Server 2003: Taking Root and Intermediate CA's offline causers faiure in Enterprise CA

I installed 3 CA's in lab environment: SA Root CA SA Intermediate CA Enterprise CA (also DC) The instructor recommends taking Root and Intermediate CA's offline once the Enterprise CA has been ...
1
vote
1answer
1k views

How can we clear CRL cache in Windows Server 008 using certutil command?

I know we can clear the CRL Cache in Windows Server 2008 using the certification authority UI. However, I want to automate the process and therefore looking a way to do it from command line. Is it ...
1
vote
1answer
163 views

Considerations for certificate revocation for intermittently isolated ad-hoc networks

I'm trying to decide on a certificate revocation strategy for a solution I'm designing (that will utilize Dogtag PKI, per customer request). The obvious choices seem to be using a CRL or using OCSP. ...
1
vote
1answer
241 views

What should be the CRL publishing period for corporate environments?

I am trying to suggest a CRL publishing period for a Microsoft CA, the user certificates are going to be used for digital signature.There can be cases that a user certificate may be revoked. ...
1
vote
1answer
192 views

How to extract CRL location from x509 certificate using OpenSSL utility

I need to extract the crl location from a certificate authority so I can use that in verifying certificates. Is this possible using the openssl utility other than using the -text option and attempting ...
1
vote
0answers
317 views

The revocation function was unable to check revocation for the certificate

I need to pass IIS certificate authentication on Windows Server 2012. The root cert haven't got any revocation lists but I'm getting exception: The revocation function was unable to check ...
1
vote
1answer
377 views

CRL Check Questions

Windows XP | IE 7 Hi guys, From time to time, I'm seeing the following error come up: Revocation information for the security certificate for this site is not available. Do you want to ...
0
votes
4answers
584 views

Can I find out what certificate revocation server an application is contacting?

I'm trying to install an application on a machine running Windows XP Pro. There are two different servers being contacted, both using the same wildcard certificate (GoDaddy). One via https, one ...
0
votes
1answer
177 views

Does IIS 6.0 Log CRL Checks?

I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
0
votes
1answer
2k views

Found CRL is expired - revoking all certificates until you get an updated CRL

My Apache-based application running on my VPS has recently stopped serving SSL transactions. I am getting errors like the following in the error_log: [Tue Aug 24 12:39:00 2010] [warn] Found CRL is ...
0
votes
1answer
637 views

How do I manually publish a CRL for a certificate?

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
0
votes
0answers
466 views

Network Error (dns unresolved hostname)

I've been getting the following error when trying to access a site on my web server: Error message: HTTP 403.13 Forbidden: client certificate revoked So I took a look around and went to server in ...
0
votes
0answers
2k views

Certificate verification fails: Error retrieving URL: This network connection does not exist

I have a test environment where I test smart card logon using a third party CA. I have added the trusted third party root CA to NTAuth store for smart card authentication and set up a web server to ...
0
votes
1answer
417 views

SSTP SERVER without certificate check

Is it possible to make a SSTP server where clients don't need certificates? If I want to use linux or microtik routeros as a client, do I have to do something extra in the SSTP server (Windows Server ...
0
votes
1answer
899 views

Openvpn intermediate CA CRL Question

I have created a CA and an intermediate CA using easy-rsa 2.0. On the Openvpn server I use the intermediate certificate export_ca (as per the easy-rsa spec). When I revoke a certificate on my ...