5 ms·

No, presenting a certificate that has been rekeyed does not mean that the old certificate stopped being cryptographically valid. In fact the old cert will alwa

by mpyne 13y ago

No, presenting a certificate that has been rekeyed does not mean that the old certificate stopped being cryptographically valid. In fact the old cert will always be cryptographically valid, which is why a separate revocation list has to be created as a positive acknowledgement that the old cert, though valid, should not be trusted.

lmz 13y ago
Do the browsers actually use revocation checking?
- sneak 13y ago
  Some do, but most of them fail unsafe when the check endpoint is unavailable IIRC.
- falcolas 13y ago
  Firefox does. Found that out in my development box which I hadn't updated with the new certs, the old certs showed up as revoked and Firefox wouldn't let me proceed.
schrodinger 13y ago
I understand that, but I thought in practice most CAs will automatically revoke the former certificate when rekeying. It sounds like godaddy does, at least.
- mpyne 13y ago
  That's up to the CA. It seems that StartSSL doesn't automatically revoke an old one even with rekeying.