RE: CAPICOM: how to check root certificate validity and existence?
From: lelteto (lelteto_at_discussions.microsoft.com)
Date: 11/23/04
- Previous message: lelteto: "RE: How Outlook Express use my own CSP and my own encryption algrithum"
- In reply to: AL: "CAPICOM: how to check root certificate validity and existence?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 23 Nov 2004 08:21:04 -0800
The certificate (and, generally, certificates) are deemed VALID unless they
explicitly revoked via a CRL list. If no CRL revoked the (now non-existent)
CA's root cert than it is still valid.
BTW this is the correct behavior. Despite the fact that the CA now doesn't
exist that does not make it 'untrustworthy' in the PAST. WHEN the CA existed
you can assume it signed certs only in good faith, so any cert which was
signed that root cert was valid.
The problem you may have is that this CA cannot issue CRLs any more, so you
have no idea whether any of the certs became invalid (because of private key
compromise). If you worry about this you just have to DELETE that root CA
from your root cert store.
Laszlo Elteto
SafeNet, Inc.
"AL" wrote:
> Hello,
> I'm trying to verify the validity of a Root Certificate, which almost
> works unless... the CA does not more exist!
> I mean, if I have a valid Root cert in my trusted root store, I always
> get an answer it is valid from the following code (VB 6):
>
> rootCert.IsValid.CheckFlag = CAPICOM_CHECK_ONLINE_ALL Or
> CAPICOM_CHECK_TRUSTED_ROOT
>
>
> If rootCert.IsValid.Result Then
> ......
> ' always get true here
>
> else
>
> ....
> end if
>
> The strange thing is I get an ok even if the CA does not exist anymore,
> or it is not reachable by the client doing the above verification.
> Is there a way to get a false answer by that check, when the CA is not
> available or it is not reachable?
>
> Thank you,
> AL.
>
- Previous message: lelteto: "RE: How Outlook Express use my own CSP and my own encryption algrithum"
- In reply to: AL: "CAPICOM: how to check root certificate validity and existence?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
