Full Disclosure mailing list archives
Re: The merits and uses of CAs
From: Valdis.Kletnieks () vt edu
Date: Mon, 05 Jan 2009 20:43:52 -0500
On Mon, 05 Jan 2009 23:55:59 GMT, Christopher Pritchard said:
previous certificate became invalid (for example due to a date issue). It should also be possible to have semi-centralised CRLs that browsers would check for occasions when the server admin wants to change certificates, they could post the old one up on the list and the browser wouldn't warn when a new certificate is presented.
Something to consider: In most cases, the CRL that you are supposed to check to see if a cert has been revoked is listed *in the cert you're checking*. That's all fine and dandy if you're dealing with a legitimate CA that's revoking a cert for good reason. However, it is interesting to consider what happens when a dodgy CA issues a cert - they have some good reasons to point the CRL at never-never land. So - if you were a miscreant running a dodgy CA, where would *you* point the CRL? If you were a browser designer, what would you do if you found a CRL that pointed nowhere? One option is to not allow the use of a cert that you can't contact the CRL - except that becomes a massive single point of failure. If users can't do their home banking because their bank's CA is unreachable due to severe backhoe fade, they won't be very happy with their browser.
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: FD / lists.grok.org - bad SSL cert, (continued)
- Re: FD / lists.grok.org - bad SSL cert chort (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert James Matthews (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- The merits and uses of CAs Christopher Pritchard (Jan 05)
- Re: The merits and uses of CAs Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert chort (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Volker Tanger (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Avraham Schneider (Jan 06)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert anonymous pimp (Jan 05)
- Re: anonymous pimp's ideas of list etiquette (was: FD / lists.grok.org - bad SSL cert) Tim (Jan 05)