Bugtraq mailing list archives
Windows doesn't verify digital signature of CRL files
From: "Michael Howard" <mikehow () microsoft com>
Date: Tue, 10 Aug 2004 16:47:35 -0700
CryptoAPI in Windows will always verify the CRL signature when determining revocation status of a certificate. While CertVerifyCertRevocation can be used to validate certificates, we recommend developers validate certificates using CertGetCertificateChain in their code because it will construct a certificate chain, download all necessary CRLs and validate the certificate chain as defined by the IETF standard (RFC 3280) on certificate validation. Generally we recommend devs call CertGetCertificateChain and CertVerifyCertificateChainPolicy to validate certs rather than call WinVerifyTrust or build their own verification algorithm using APIs such as CertGetCRLFromStore, CertGetIssuerCertificateFromStore or CertVerifyRevocation. Finally, the CRL UI in Windows shows you what is in the CRL. Valid or not. But code in Windows validates the CRL when needed. I hope that helps... Cheers, Michael [Writing Secure Code 2nd Ed] http://www.microsoft.com/mspress/books/5957.asp [Protect Your PC] http://www.microsoft.com/protect [Blog] http://blogs.msdn.com/michael_howard
Current thread:
- Windows doesn't verify digital signature of CRL files Faro Poplar (Aug 09)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Neil Gierman (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Jack Lloyd (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 11)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Neil Gierman (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Valdis . Kletnieks (Aug 10)
- Re: Windows doesn't verify digital signature of CRL files Thomas Walpuski (Aug 10)
- <Possible follow-ups>
- Windows doesn't verify digital signature of CRL files Michael Howard (Aug 11)