Questions tagged [crl]

A Certificate Revocation List (CRL) is a blacklist of revoked or compromised serial numbers of certificates. As a serial number has no direct relationship to a certificate and can be fabricated in a compromised CA, it is considered a weak blacklist.

Filter by
Sorted by
Tagged with
1 vote
1 answer
3k views

How do I manually publish a CRL for a certificate?

I have setup a new server and installed Remote Access and Certificate Authority services so I can configure it as a VPN. I have created my own certificate through http://localhost/certsvr, and have ...
David Anderson's user avatar
3 votes
1 answer
4k views

How often is CRL refreshed, and how to force it to be?

I have a web service running under IIS 7 that requires an X509 client certificate. I know that the server that it rus on needs access to DigiCert.com in order to be able to get the CRL (Certificate ...
lockstock's user avatar
  • 133
4 votes
1 answer
8k views

How to reload Certificate Revocation List (CRL) in nginx?

I have set CRL file in nginx with ssl_crl directive: ssl_crl /mypath/crl.pem However, I noticed that adding or removing revoked certificates from crl.pem apply only when I restart or reload nginx ...
bmihelac's user avatar
  • 143
3 votes
1 answer
51k views

Revocation status of DC can't be verified

A Domain Controller within my forest was working fine (as the story usually goes). Then, suddenly, I can't logon with my smart card. Instead, I'm greeted with the following message: The system ...
Federer's user avatar
  • 211
4 votes
2 answers
1k views

Migrate an intermediate CA to a new root

Using the Microsoft CA is there any way to cut over to a new certificate authority from an intermediate authority? Both my systems are Microsoft CAs - I have a 2008 R2 Enterprise CA (intermediate) ...
Tim Brigham's user avatar
  • 15.6k
7 votes
1 answer
7k views

RDP connection to domain server from non-domain client prompts "A revocation check could not be performed"

I've got about 30 Windows 2008 R2 servers as members of a domain, and am attempting to configure the certificates part correctly for remote desktop access to those servers. The catch is that the ...
growse's user avatar
  • 8,050
3 votes
2 answers
7k views

How to extract CRL location from x509 certificate using OpenSSL utility

I need to extract the crl location from a certificate authority so I can use that in verifying certificates. Is this possible using the openssl utility other than using the -text option and attempting ...
Shawn J. Goff's user avatar
2 votes
3 answers
13k views

How Can I Disable CRL Checks For A Windows 2008 App Using WinHTTP?

I've got a Windows 2008 server with an app that uses WinHTTP for SSL sessions. The server is isolated from the internet but still tries to connect to CRL distribution points, which leads to some ...
Mike B's user avatar
  • 12k
6 votes
3 answers
4k views

Can Windows log CryptoAPI CRL timouts?

I suspect that the process of building the CRL cache may cause latency in some applications. We have several .NET applications that occasionally "act slow" with no CPU or disk access. I suspect that ...
makerofthings7's user avatar
6 votes
1 answer
2k views

How large is the certificate OCSP and CRL cache in my Windows server?

How can I see the size of the in-memory OCSP cache to a CRL cache in my Domain Controllers? In other words, most Windows process that uses CryptoAPIs have an in-memory cache of every CRL and OCSP ...
makerofthings7's user avatar
1 vote
1 answer
111 views

Windows Server 2003: Taking Root and Intermediate CA's offline causers faiure in Enterprise CA

I installed 3 CA's in lab environment: SA Root CA SA Intermediate CA Enterprise CA (also DC) The instructor recommends taking Root and Intermediate CA's offline once the Enterprise CA has been ...
Dean's user avatar
  • 1,009
1 vote
1 answer
13k views

How to publish a CRL for an internal Windows certification authority?

I have an Active Directory domain with an Enterprise Root Certification Authority in it; the domain uses a private domain name ("domain.local"), and we also have a public domain name ("domain.com"). ...
Massimo's user avatar
  • 71.3k
1 vote
1 answer
3k views

How can we clear CRL cache in Windows Server 008 using certutil command?

I know we can clear the CRL Cache in Windows Server 2008 using the certification authority UI. However, I want to automate the process and therefore looking a way to do it from command line. Is it ...
Andy Brikshaw's user avatar
2 votes
2 answers
4k views

Maximum Size of CRL

Is there a CRL size that is beyond a practical limit? I did not find anything in the RFC. Is there any limit at all on the size of CRLs?
Engineer2021's user avatar
-1 votes
1 answer
2k views

SSTP SERVER without certificate check

Is it possible to make a SSTP server where clients don't need certificates? If I want to use linux or microtik routeros as a client, do I have to do something extra in the SSTP server (Windows Server ...
sazu1976's user avatar
3 votes
1 answer
6k views

Implications of Root CA without CRL

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays. By ...
cvaldemar's user avatar
  • 1,126
0 votes
1 answer
320 views

Does IIS 6.0 Log CRL Checks?

I am adding a 3rd party OCSP responder(Tumbleweed) plugin to IIS 6.0/Windows. I have the 3rd party tool configured to check the revocation status and would like to assert that IIS is not making a ...
Kevin's user avatar
  • 1
3 votes
2 answers
35k views

Reset local Certificate Revocation List (CRL) manual

How can I reset local CRL (in OS local cash) in Windows OS (XP, Windows 7) manual? We need to reset local CRL because otherwise the OS will use local CRL until "next update" period. As described in "...
Sasha's user avatar
  • 229
1 vote
1 answer
430 views

Considerations for certificate revocation for intermittently isolated ad-hoc networks

I'm trying to decide on a certificate revocation strategy for a solution I'm designing (that will utilize Dogtag PKI, per customer request). The obvious choices seem to be using a CRL or using OCSP. I'...
G__'s user avatar
  • 314
3 votes
1 answer
399 views

Hierarchical certification authorities and CRLs

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or ...
LawrenceC's user avatar
  • 1,212
1 vote
1 answer
1k views

What should be the CRL publishing period for corporate environments?

I am trying to suggest a CRL publishing period for a Microsoft CA, the user certificates are going to be used for digital signature.There can be cases that a user certificate may be revoked. ...
abmv's user avatar
  • 133
3 votes
1 answer
3k views

Openvpn intermediate CA CRL Question

I have created a CA and an intermediate CA using easy-rsa 2.0. On the Openvpn server I use the intermediate certificate export_ca (as per the easy-rsa spec). When I revoke a certificate on my ...
Hilton D's user avatar
  • 279
0 votes
1 answer
7k views

Found CRL is expired - revoking all certificates until you get an updated CRL

My Apache-based application running on my VPS has recently stopped serving SSL transactions. I am getting errors like the following in the error_log: [Tue Aug 24 12:39:00 2010] [warn] Found CRL is ...
user avatar
2 votes
1 answer
556 views

CRL Check Questions

Windows XP | IE 7 Hi guys, From time to time, I'm seeing the following error come up: Revocation information for the security certificate for this site is not available. Do you want to ...
Mike B's user avatar
  • 12k

1
2