3 ms·

Doesn't rekeying result in the old certificate based on the compromised private key being revoked?

• mpyne 13y ago
  No, presenting a certificate that has been rekeyed does not mean that the old certificate stopped being cryptographically valid. In fact the old cert will always be cryptographically valid, which is why a separate revocation list has to be created as a positive acknowledgement that the old cert, though valid, should not be trusted.
  • lmz 13y ago
    Do the browsers actually use revocation checking?
    • sneak 13y ago
      Some do, but most of them fail unsafe when the check endpoint is unavailable IIRC.
    • falcolas 13y ago
      Firefox does. Found that out in my development box which I hadn't updated with the new certs, the old certs showed up as revoked and Firefox wouldn't let me proceed.
  • schrodinger 13y ago
    I understand that, but I thought in practice most CAs will automatically revoke the former certificate when rekeying. It sounds like godaddy does, at least.
    • mpyne 13y ago
      That's up to the CA. It seems that StartSSL doesn't automatically revoke an old one even with rekeying.