Questions tagged [crl]
A Certificate Revocation List (CRL) is a blacklist of revoked or compromised serial numbers of certificates. As a serial number has no direct relationship to a certificate and can be fabricated in a compromised CA, it is considered a weak blacklist.
74
questions
1
vote
1
answer
3k
views
How do I manually publish a CRL for a certificate?
I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
3
votes
1
answer
4k
views
How often is CRL refreshed, and how to force it to be?
I have a web service running under IIS 7 that requires an X509 client certificate. I know that the server that it rus on needs access to DigiCert.com in order to be able to get the CRL (Certificate ...
4
votes
1
answer
8k
views
How to reload Certificate Revocation List (CRL) in nginx?
I have set CRL file in nginx with ssl_crl directive:
ssl_crl /mypath/crl.pem
However, I noticed that adding or removing revoked certificates from crl.pem apply only when I restart or reload nginx ...
3
votes
1
answer
51k
views
Revocation status of DC can't be verified
A Domain Controller within my forest was working fine (as the story usually goes).
Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message:
The system ...
4
votes
2
answers
1k
views
Migrate an intermediate CA to a new root
Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority?
Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
7
votes
1
answer
7k
views
RDP connection to domain server from non-domain client prompts "A revocation check could not be performed"
I've got about 30 Windows 2008 R2 servers as members of a domain, and am attempting to configure the certificates part correctly for remote desktop access to those servers.
The catch is that the ...
3
votes
2
answers
7k
views
How to extract CRL location from x509 certificate using OpenSSL utility
I need to extract the crl location from a certificate authority so I can use that in verifying certificates. Is this possible using the openssl utility other than using the -text option and attempting ...
2
votes
3
answers
13k
views
How Can I Disable CRL Checks For A Windows 2008 App Using WinHTTP?
I've got a Windows 2008 server with an app that uses WinHTTP for SSL sessions. The server is isolated from the internet but still tries to connect to CRL distribution points, which leads to some ...
6
votes
3
answers
4k
views
Can Windows log CryptoAPI CRL timouts?
I suspect that the process of building the CRL cache may cause latency in some applications.
We have several .NET applications that occasionally "act slow" with no CPU or disk access. I suspect that ...
6
votes
1
answer
2k
views
How large is the certificate OCSP and CRL cache in my Windows server?
How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers?
In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
1
vote
1
answer
111
views
Windows Server 2003: Taking Root and Intermediate CA's offline causers faiure in Enterprise CA
I installed 3 CA's in lab environment:
SA Root CA
SA Intermediate CA
Enterprise CA (also DC)
The instructor recommends taking Root and Intermediate CA's offline once the Enterprise CA has been ...
1
vote
1
answer
13k
views
How to publish a CRL for an internal Windows certification authority?
I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
1
vote
1
answer
3k
views
How can we clear CRL cache in Windows Server 008 using certutil command?
I know we can clear the CRL Cache in Windows Server 2008 using the certification authority UI. However, I want to automate the process and therefore looking a way to do it from command line. Is it ...
2
votes
2
answers
4k
views
Maximum Size of CRL
Is there a CRL size that is beyond a practical limit? I did not find anything in the RFC. Is there any limit at all on the size of CRLs?
-1
votes
1
answer
2k
views
SSTP SERVER without certificate check
Is it possible to make a SSTP server where clients don't need certificates? If I want to use linux or microtik routeros as a client, do I have to do something extra in the SSTP server (Windows Server ...
3
votes
1
answer
6k
views
Implications of Root CA without CRL
I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays.
By ...
0
votes
1
answer
320
views
Does IIS 6.0 Log CRL Checks?
I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
3
votes
2
answers
35k
views
Reset local Certificate Revocation List (CRL) manual
How can I reset local CRL (in OS local cash) in Windows OS (XP, Windows 7) manual? We need to reset local CRL because otherwise the OS will use local CRL until "next update" period.
As described in "...
1
vote
1
answer
430
views
Considerations for certificate revocation for intermittently isolated ad-hoc networks
I'm trying to decide on a certificate revocation strategy for a solution I'm designing (that will utilize Dogtag PKI, per customer request). The obvious choices seem to be using a CRL or using OCSP. I'...
3
votes
1
answer
399
views
Hierarchical certification authorities and CRLs
If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
1
vote
1
answer
1k
views
What should be the CRL publishing period for corporate environments?
I am trying to suggest a CRL publishing period for a Microsoft CA, the user certificates are going to be used for digital signature.There can be cases that a user certificate may be revoked.
...
3
votes
1
answer
3k
views
Openvpn intermediate CA CRL Question
I have created a CA and an intermediate CA using easy-rsa 2.0. On the Openvpn server I use the intermediate certificate export_ca (as per the easy-rsa spec). When I revoke a certificate on my ...
0
votes
1
answer
7k
views
Found CRL is expired - revoking all certificates until you get an updated CRL
My Apache-based application running on my VPS has recently stopped serving SSL transactions.
I am getting errors like the following in the error_log:
[Tue Aug 24 12:39:00 2010] [warn] Found CRL is ...
2
votes
1
answer
556
views
CRL Check Questions
Windows XP | IE 7
Hi guys,
From time to time, I'm seeing the following error come up:
Revocation information for the
security certificate for this site is
not available. Do you want to
...