Is it only controlled locally via hashsum or does the browser contact the webserver of the CA to verify the certificate?


The browser will have the public keys of various root authorities cached locally. If you use windows you occasionally see an update with 'root certificates' in the name, that's what it is. For a valid certificate the hierarchy can be traced all the way back to a valid root CA's public key, possibly via several resellers.

It is possible to self sign a certificate and the first time you access a site with such a certificate you will receive a warning, and it will ask if you wish to continue and if you want to add the key to the list of trusted keys within the browser, this stops the warning coming up again - and you will be told if the key changes.

  • 1
    It'd be good to mention CRLs for a more complete picture. – Shane Madden Jun 5 '11 at 17:58
  • I had totally forgotten CRLs exist and even now can't remember anything about them. My memory is rusty as it's been years since I learnt this stuff and I haven't used it since then. Feel free add info about them if you want. – Phil Jun 5 '11 at 18:47
  • There are several steps to proper validation. First ensure the other guy has the private key matching the cert he gave you, next you build a chain of certs from the one presented to a cert you already trust ("root" cert); a critical part of this process is to ensure that you only consider certificates that are valid - the way to do that is to go to the certificate authority and either retrieve a current CRL or to explicitly ask about the certificate at hand using either OCSP or a varient. – Ram Sep 17 '11 at 16:46

CRL or Certificate Revocation List is pretty important. A certificate issued might be valid according to a browser because the browser trusts the root CA (Certificate Authority) of the certificate. But the CA can always revoke a certificate it's issued. The only way a browser would know it's been revoked would be to check the CRL. Certificates usually come with an address of the CRL but by default, not all browsers care if the CRL list is available. I recall that at least one version of IE just sort of assumed that if it was a validly-issued cert, that's good enough if it can't contact the CRL properly. That is, if I can't see if you're revoked or not, I'll just assume not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.