Cyberstudy
PDF p.63 In progress

Certificate Revocation

Open PDF at p.63 19 flashcards

Summary

PDF p.63

Certificates can be revoked or suspended by the owner or the certificate authority (CA) for various reasons, such as key compromise or business closure. A certificate revocation list (CRL) is maintained by the CA to inform users of the status of certificates. The Online Certificate Status Protocol (OCSP) provides real-time certificate status information.

In plain words

Supplementary — not from your PDF

If a certificate's private key is stolen, or it shouldn't be trusted for another reason, the CA revokes it. Clients learn about revoked certificates from a certificate revocation list (CRL) or by asking an OCSP server in real time.

Detailed explanation

PDF p.63
  • Revocation and Suspension
    • Revoked Certificate: No longer valid and cannot be reinstated.
    • Suspended Certificate: Can be re-enabled.
    • Reasons for Revocation/Suspension: Key compromise, business closure, user departure, domain name change, misuse, etc.
    • Codes: Unspecified, Key Compromise, CA Compromise, Superseded, Cessation of Operation, Certificate Hold (for suspension).
  • Certificate Revocation List (CRL)
    • Purpose: Lists all revoked and suspended certificates.
    • Accessibility: Must be accessible to anyone relying on the CA's certificates.
    • Attributes
      • Publish Period: Date and time of publication.
      • Distribution Points: Locations where the CRL is published.
      • Validity Period: Time during which the CRL is authoritative.
      • Signature: Signed by the CA to verify authenticity.
    • Risks: Certificates might be accepted if an up-to-date CRL is not published or if the browser/application does not check the CRL.
  • Online Certificate Status Protocol (OCSP)
    • Function: Provides real-time status of a certificate.
    • Details: Published in the certificate.
    • OCSP Servers: Query the certificate database directly or depend on CRLs.

Important terms

taken from the text above
Revoked Certificate
No longer valid and cannot be reinstated.
Suspended Certificate
Can be re-enabled.
Reasons for Revocation/Suspension
Key compromise, business closure, user departure, domain name change, misuse, etc.
Codes
Unspecified, Key Compromise, CA Compromise, Superseded, Cessation of Operation, Certificate Hold (for suspension).
Accessibility
Must be accessible to anyone relying on the CA's certificates.
Publish Period
Date and time of publication.
Distribution Points
Locations where the CRL is published.
Validity Period
Time during which the CRL is authoritative.
Signature
Signed by the CA to verify authenticity.
OCSP Servers
Query the certificate database directly or depend on CRLs.
OCSP Online Certificate Status Protocol CRL Certificate Revocation List

Examples & real-world scenarios

Supplementary — not from your PDF
  • Revoked for key compromise after a server breach.
  • Suspended ('certificate hold') while an issue is investigated.
  • OCSP giving an instant good, revoked or unknown answer.

Scenario

A web server is breached and its private key may have been copied. The admin revokes the certificate immediately and installs a new one with a new key pair. Otherwise an attacker could impersonate the site until the old certificate expired.

Common mistakes

Supplementary — not from your PDF
  • Treating revoked and suspended as the same. Suspended can be reinstated; revoked can't.
  • Assuming revocation always works. Clients that don't check the CRL or OCSP can still accept a revoked certificate.

Practical skills

Supplementary — not from your PDF
  • Explain when to revoke and how clients find out.

What I should remember

Key Points PDF p.63
  • Revocation and Suspension
    • Revoked: Cannot be reinstated.
    • Suspended: Can be re-enabled.
    • Reasons: Key compromise, business closure, etc.
    • Codes: Unspecified, Key Compromise, etc.
  • Certificate Revocation List (CRL)
    • Lists: Revoked and suspended certificates.
    • Attributes: Publish Period, Distribution Points, Validity Period, Signature.
    • Risks: Acceptance of revoked certificates if CRL is outdated or not checked.
  • Online Certificate Status Protocol (OCSP)
    • Real-Time Status: Provides current certificate status.
    • OCSP Servers: Query database or depend on CRLs.