Re: CRL

From: Sergio Dutra [MS] (sergiod@online.microsoft.com)
Date: 03/31/03


From: "Sergio Dutra [MS]" <sergiod@online.microsoft.com>
Date: Mon, 31 Mar 2003 07:59:19 -0800


There is no CRL object in any managed class. Through p-invoking, however,
you can call the Crypto APIs to do what you want.

You can load the CRL file into a CRL_CONTEXT through a call to
CryptQueryObject. From there you can go into the CRL_INFO portion of the
CRL_CONTEXT and iterate through the list of revocation entries. Each
revocation entry consists of the serial number of the certificate that was
revoked and the revocation date. So, just from this information, you can at
least list the serial numbers that were revoked.

If you wanted to associate those serial numbers with real certs, you would
have to have those certs around, so that you could then find them by serial
number and issuer (the issuer of the CRL has to be the same as the issuer of
the cert).

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Marcelo" <sms2k@hotmail.com> wrote in message
news:OA6gmCJ9CHA.2104@TK2MSFTNGP11.phx.gbl...
> Hi,
>
> is it possible from C# to list all certificates and their revogation date
> from a CRL file??
>
> thanks in advance
>
> Marcelo
>
>


Relevant Pages

  • Re: How to install a new Enterprise Root Certificate Authority to replace an old one?
    ... > Enterprise Root CA to this new server (since apparently Enterprise CAs can't ... The biggest issue will be the need to redeploy all certs. ... CRL will no longer be available. ... and getting the replacement certificates deployed. ...
    (microsoft.public.windows.server.security)
  • Re: PKIView reports incorrect URLs, different to the CA configuration
    ... of the locations specified in old certs, the old certs may fail to validate. ... > However, out of the three URLS (AIA, CRL, and delta CRL+) PKIView has> only detected that one of these has changed. ...
    (microsoft.public.platformsdk.security)
  • Re: Problem with IIS5 - "expired" CRLs not working?
    ... Revocation checking, per se, is NOT the problem. ... The problem is that when the CRL in the ICA is expired, ... > certs as an indicator that revocation does not need to be checked. ...
    (microsoft.public.inetserver.iis.security)
  • Re: MS: David Cross
    ... I have set up in my internal lab to use the CA to issue the certs and it ... is checking the crl. ... These are both behind an ISA 2000 box, ... >>> customer identity before approving the request. ...
    (microsoft.public.win2000.security)
  • Re: Problem with IIS5 - "expired" CRLs not working?
    ... Revocation checking, per se, is NOT the problem. ... The problem is that when the CRL in the ICA is expired, ... > certs as an indicator that revocation does not need to be checked. ...
    (microsoft.public.platformsdk.security)