|Main Archive Page > Month Archives > full-disclosure-uk archives|
On Mon, 05 Jan 2009 23:55:59 GMT, Christopher Pritchard said:
> previous certificate became invalid (for example due to a date issue). It
> should also be possible to have semi-centralised CRLs that browsers would
> check for occasions when the server admin wants to change certificates, they
> could post the old one up on the list and the browser wouldn't warn when a
> new certificate is presented.
Something to consider: In most cases, the CRL that you are supposed to check to see if a cert has been revoked is listed *in the cert you're checking*. That's all fine and dandy if you're dealing with a legitimate CA that's revoking a cert for good reason. However, it is interesting to consider what happens when a dodgy CA issues a cert - they have some good reasons to point the CRL at never-never land.
So - if you were a miscreant running a dodgy CA, where would *you* point the CRL?
If you were a browser designer, what would you do if you found a CRL that pointed nowhere? One option is to not allow the use of a cert that you can't contact the CRL - except that becomes a massive single point of failure. If users can't do their home banking because their bank's CA is unreachable due to severe backhoe fade, they won't be very happy with their browser.