{"id":10463,"date":"2021-03-10T15:49:17","date_gmt":"2021-03-10T15:49:17","guid":{"rendered":"http:\/\/www.max-sperling.bplaced.net\/?p=10463"},"modified":"2024-02-16T10:36:28","modified_gmt":"2024-02-16T10:36:28","slug":"certificate-status-checking","status":"publish","type":"post","link":"http:\/\/www.max-sperling.bplaced.net\/?p=10463","title":{"rendered":"Certificate status checking"},"content":{"rendered":"<p>A certificate has a specific expiary date and if it got untrusted by the CA in this time (e.g. its private key has been leaked) you want to know that.<\/p>\n<hr>\n<p><strong>CRL<\/strong> (Certificate Revocation List)<br \/>\n<p><img src=http:\/\/www.plantuml.com\/plantuml\/img\/POv12W8n34NtFSN7lHv0644ghbnPBn3Ro9GPqc6QqUlRggYZMGH-NlvFp42ZHXy74iN2zf555w0CQsR4yNZbyK7SdDZZ0L-qI6UQ1ZQ9iDUO19br6j0qncAvWSCQJai2JWU7bYJabZesha9R8Kk0vtBY4ZqfFsqrjy1TkacVA5Jz0cLgM_RTmxD2Lj8f6-eLzXE2aQ-fus1Gwlt7zfp-_k0-CsgRh-wZnDp-xaemTm00 alt=\"PlantUML Syntax:<br \/>\nparticipant &#8220;Client&#8221; as C<br \/>\nparticipant &#8220;Server&#8221; as S<br \/>\nparticipant &#8220;CRL Server&#8221; as CRLS<\/p>\n<p>== Connection setup ==<br \/>\nC -> S : Start TLS handshake<br \/>\nS -> C : Send certificate<br \/>\nC -> CRLS : Download CRL<br \/>\nC -> C : Check cert. status<br \/>\nalt Certificate revoked<br \/>\n    C -> S : Abort TLS handshake<br \/>\nelse else<br \/>\n    C -> S : Finish TLS handshake<br \/>\nend<br \/>\n\" usemap=\"#plantuml_map\"><\/p><\/p>\n<p>Contra: Downloading the CRL generates traffic.<\/p>\n<hr>\n<p><strong>OCSP<\/strong> (Online Certificate Status Protocol)<br \/>\n<p><img src=http:\/\/www.plantuml.com\/plantuml\/img\/POxHQiCm34NV_HMYxzq7538e7diAhCJx0TNMYAWdPxQI_Vxi1BQcyuD1d2FTQoRCofud58M3ZKoY1y02rko8exnGNedRapVhBd27s_oWsA6_D-pWJDV19PDF4bWv2NITMHVX-DmudE0bVKjC6EhODzqc4VAhN4ZdgQtOfZVPQSs3zzx1Y1BAY3Soswq6IG9ugeK-sAFIjhR5dM2WhvcAhi8J54MT2ooCDIKpHf3vyqhPO5ImVpSWqv9k50pKzrlZV4t_Qb0i1EtRgwyiNCP7LuBv0G00 alt=\"PlantUML Syntax:<br \/>\nparticipant &#8220;Client&#8221; as C<br \/>\nparticipant &#8220;Server&#8221; as S<br \/>\nparticipant &#8220;OCSP Server&#8221; as OCSPS<br \/>\nparticipant &#8220;CRL Server&#8221; as CRS<\/p>\n<p>== Precondition ==<br \/>\nOCSPS -> CRS : Download CRL<br \/>\n== Connection setup ==<br \/>\nC -> S : Start TLS handshake<br \/>\nS -> C : Send certificate<br \/>\nC -> OCSPS : Request cert. status via serial number<br \/>\nalt Certificate revoked<br \/>\n    C -> S : Abort TLS handshake<br \/>\nelse else<br \/>\n    C -> S : Finish TLS handshake<br \/>\nend<br \/>\n\" usemap=\"#plantuml_map\"><\/p><\/p>\n<p>Contra: The OSCP Server knows your requests.<\/p>\n<hr>\n<p><strong>OCSP Stapling<\/strong> (Online Certificate Status Protocol Stapling)<br \/>\n<p><img src=http:\/\/www.plantuml.com\/plantuml\/img\/POv1QiGm34NtFeMOxT0UO203nQMhG8Uu5z3OAX7ZogcjfDTlx9QIJBqmYFV-byo4MTdpXA9mi959z01Om9eTSPGNoesuFNcrxW8RNESxnGxzrh23Crq7bqm-IM3b9D1rfWNXuLmvdE0vVKbC6DQnhxfD8kIRN4ZdgKPirQliTDq7Rxs34IMK4MzaMbShFS50dpCL1KzP7w4ewbnWOLohCcC4cJ-kb7yYjlQHX2RpEtjKWkDlo61Ki1kGQKat2WRMztVEqpNzEuTY8QZVNdrXuJBUknBCDm00 alt=\"PlantUML Syntax:<br \/>\nparticipant &#8220;Client&#8221; as C<br \/>\nparticipant &#8220;Server&#8221; as S<br \/>\nparticipant &#8220;OCSP Server&#8221; as OCSPS<br \/>\nparticipant &#8220;CRL Server&#8221; as CRS<\/p>\n<p>== Precondition ==<br \/>\nOCSPS -> CRS : Download CRL<br \/>\n== Connection setup ==<br \/>\nC -> S : Start TLS handshake<br \/>\nS -> OCSPS: Request cert. status via serial number<br \/>\nS -> C : Send certificate + status<br \/>\nalt Certificate revoked<br \/>\n    C -> S : Abort TLS handshake<br \/>\nelse else<br \/>\n    C -> S : Finish TLS handshake<br \/>\nend<br \/>\n\" usemap=\"#plantuml_map\"><\/p><\/p>\n<p>Contra: Nothing yet.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A certificate has a specific expiary date and if it got untrusted by the CA in this time (e.g. its<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false},"categories":[26],"tags":[],"_links":{"self":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts\/10463"}],"collection":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10463"}],"version-history":[{"count":1,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts\/10463\/revisions"}],"predecessor-version":[{"id":16802,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=\/wp\/v2\/posts\/10463\/revisions\/16802"}],"wp:attachment":[{"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10463"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.max-sperling.bplaced.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}