![]() A CRL can also be published immediately after a certificate has been revoked. Reasons to revoke a certificate according to RFC 5280 are:Ī CRL is generated and published periodically, often at a defined interval. If, in this example, the private key was found and nobody had access to it, the status could be reinstated, and the certificate is valid again, thus removing the certificate from future CRLs. Hold This reversible status can be used to note the temporary invalidity of the certificate (e.g., if the user is unsure if the private key has been lost). ![]() The most common reason for revocation is the user no longer being in sole possession of the private key (e.g., the token containing the private key has been lost or stolen). ![]() Certificates may also be revoked for failure of the identified entity to adhere to policy requirements, such as publication of false documents, misrepresentation of software behaviour, or violation of any other policy specified by the CA operator or its customer. Revoked A certificate is irreversibly revoked if, for example, it is discovered that the certificate authority (CA) had improperly issued a certificate, or if a private-key is thought to have been compromised. There are two different states of revocation defined in RFC 5280:
0 Comments
Leave a Reply. |