Re: CRL list

From: Shawn Corey [MSFT] (shawncor_at_online.microsoft.com)
Date: 02/09/04 

Date: Mon, 9 Feb 2004 13:18:39 -0800

If the certificate or any certificate from the same issuing CA was
previously verified on the machine then CAPI probably cached the CRL locally
to avoid having to download it again. This cert will continue to verify,
even with the box unplugged, till the CRL expires. If you want to verify
this set the system clock to past the expire date for the CRL, 1 year
usually does the trick, and the Verify should fail. If you are using
makecert or some other util to make the certs then they probably don't have
CDPs so the only check is that the root is trusted and that the signatures
of the certs are valid. 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"bob biris" <bobbiris@hotmail.com> wrote in message
news:ce8efab7.0402090628.60550ce5@posting.google.com...
> Shawn
>
> I used the oSign.verify(s, True,
> CAPICOM_VERIFY_SIGNATURE_AND_CERTIFICATE) and to be sure that it was
> doing an online checking I unplugged my machine.
>
> I ran the code again and .... it still verified!
>
> Am I missing something?
>
> Thanks

Relevant Pages

  • Re: How to revoke the root CA certificate ?
    ... signed the CRL in it, I won't try to revoke the root CA ... i'll revoke all the certificate issued by root CA but also ... > have issued any certs for use from the root, so first revoke all certs for ...
    (microsoft.public.windows.server.security)
  • Re: IAS CRL Configuration
    ... Essentially I am looking for how to review, control, initiate, verify ... that the CRL is being used/retreived/loaded by IAS. ... says that the CRL will be retreived when the previous one expires. ... certificate for which you want to configure expiration paramaters. ...
    (microsoft.public.internet.radius)
  • Re: CAPICOM - Verify signature offline
    ... build a certificate chain, even though it does not check the cert. ... Unfortunatly there is no current way to make Verify not build the chain. ... keep CAPI from going off box to retrive the certs when it builds the chain. ...
    (microsoft.public.platformsdk.security)
  • Re: How to publish crl
    ... CRL via information on the certificate that tells them where the CRL is ... > receives my digitally signed email it canīt verify the revocation of the ...
    (microsoft.public.windows.server.security)
  • Re: Obtaining CA signature from the CRL...
    ... > If you have the CRL and the CA certificate you want to verify against, ...
    (microsoft.public.platformsdk.security)
Loading