Certificate Revocation Reason Codes
Q
What are the reasons why a X.509 certificate got revoked?
✍: FYIcenter.com
A
When a certificate CA publishes a CRL (Certificate Revocation List) file
with a list of revoked certificates, a revocation reason code will be provided
for each revocation entry.
There are several reason codes commonly used in CRL files:
- 0 - Unspecified: Certificate was revoked for unspecified reason
- 1 - Key Compromise: Private key of the certificate was compromized
- 2 - CA Compromise: Private key of the certificate CA was compromized
- 3 - Affiliation Changed: Certificate owner changed affiliation
- 4 - Superseded: A new certificate was issued to replace this one
- 5 - Cessation of Operation: Certificate owner stopped operation
- 6 - Certificate Hold: Certificate was put on hold
As you can see, the most serious reason is the "2 - CA Compromise". In this case, all X.509 certificates issued by this CA must be revoked immediately. Using a certificate whose CA private key was compromized is extremely dangerous.
⇒ Examples of Revoked Certificates
2019-07-19, 2410👍, 0💬
Related Topics: