SSL certificates -- how are they validated? -- dotnet security

dotnet security : SSL certificates -- how are they validated?

Rob R. Ainscough
6/29/2005 4:00:44 PM

If I purchase an SSL certificate and install it on my web server, how is it
validated? Anytime anyone communicates with my web server does the SSL go
out to site that issued the SSL certificate to validate it? Or is this just
a one time deal? Also, can certificates be "updated" when a server is moved
or it's IP is changed (and/or domain name)?

thanks, Rob.

Rob R. Ainscough
6/30/2005 6:51:40 AM

Hi Nicole,

So it the issuer chain goes down, then no validation?

Rob.

[quoted text, click to view]

Nicole Calinoiu
6/30/2005 8:12:17 AM

[quoted text, click to view]

This behaviour depends largely on the client application. Most browsers
will check the CRLs (certificate revocation lists) along the issuer chain of
a web site certificate only once per browser launch, not for each page
visited within a site.

[quoted text, click to view]

There is generally no need to make any changes to a certificate when a
server is physically moved or when its IP address changes. However, web
server SSL certificates are mapped to the server host name, so a name
alteration would require a certificate change (even if the IP address
doesn't change).

Nicole Calinoiu
6/30/2005 10:15:35 AM

Again, it depends entirely on the client application. Most browsers will
not re-verify the CRLs for each page request, but this is no guarantee that
any given client application will not do so. Perhaps you could explain why
you are concerned about this, someone might be able to give an answer that
addresses your particular concerns.

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about dotnet security

home · blog · groups

Questions? Comments? Contact the dn