Huron.
And welcome back.
Now, in today's video, our prime focus would be over the revocation methods for the certificates.
And the topics that we'll be discussing would be CRL and the Ocsp protocol.
So when you talk about revocation method, you can understand this in an easier way.
So let's say that this is my passport.
So now there can happen that the passport gets revoked, right?
So government can revoke the passport.
So a revoked passport is no longer trusted.
So same way you can even revoke the certificates.
So let's say a certificate is issued for five years and you might see that that certificate is compromised.
So the private key associated with the certificate is compromised in the recent breach.
So you can revoke that certificate immediately.
So those revocation related aspects are the things that we'll be discussing today.
Now the first one is the CRL.
So CRL basically stands for certificate Revocation list and it basically is a list of digital signatures
that have been revoked by the issuing certificate authority before their scheduled expiration date and
should no longer be trusted.
So how things would work is you have a client, so client would be, let's say a web browser.
So before client trusts the certificate, it first checks the CRL.
So this is generally published by the certificate Authority.
So within the CRL it will look for whether that certificate that the web server has sent to the client,
is it there in the list or not?
If it is there within the list, then it is no longer trusted.
You'll get an error there.
If it is not there within the list, then you'll get a 200.
Okay.
And you will get the lock symbol if everything else is also fine.
So that is what CRL is all about.
So as we had discussed many times, what happens is that since the certificate and the private key are
within the web server and if the web server is compromised, there are a lot of cases where your web
server is compromised.
So in such cases the attacker is able to get hold of the private key there.
So if he gets the private key, he will be essentially be able to decrypt the communication.
So what the system administrator do, they contact the certificate authority and they revoke the certificate.
So what happens in revocation of certificate is certificate authority.
In case of CRL, they will put the certificates serial number within the CRL.
So anyone who goes to the website, right, they have to check the CRL and if they check the CRL and
if the list of the certificate is there, then it is not trusted.
So let's look into how exactly it might look like.
So for our test purpose we'll just open up digital ocean.com.
So let's open up the certificate associated with digital ocean.
So we'll go to details.
And if you look into the extensions only there is one extension called as CRL distribution points.
So if I open this up, you have the list.
So this is the URL from where you can download the CRL and this is important.
So let's say you have a web browser, it receives the certificate.
So now it also needs to verify whether the certificate is revoked or not.
So one of the ways is through the CRL distribution point, so the web browser will look into the CRL
distribution point.
It will fetch the URL.
So let's copy this URL and let me paste it.
So you see, after I pasted it, it automatically got downloaded here.
All right.
Now this is a file which basically contains the serial number of the certificates.
So let me quickly show you.
So from the command prompt, I'll open up cert util, I'll say dump and I'll pass on the CRL.
So basically if you see it contains huge amount of data here.
So it contains serial number as well as the revocation list.
So let me do a control C over here because this list is quite huge.
So here it basically contains two things.
One is the serial number and second is the revocation date.
So you see the number of certificates which are revoked is quite huge.
So now let's look into what exactly serial number is.
Now, if you open up the certificate yet again, now every certificate has a serial number.
This is important for you to know.
So for Digital Ocean, this is the serial number.
So if a certificate is revoked, this is the serial number that you will be seeing within the CRL.
And Certificate Authority works in that way as far as the Crls are concerned.
So you will have the serial number.
So if you see you have the serial number here and you have the revocation date.
So this has been the way of checking the revoked certificates.
However, there is a problem with CRL.
You see the more the amount of certificates which get revoked because a specific certificate authority
might have tens of thousands of certificates.
So if huge amount of certificates are being revoked, then the size of the CRL will also increase and
you will have to browser or a client who is checking whether the certificate is revoked or not.
He'll have to go through the list and if the certificate associated with your website is present at
the last of the list, it might take little amount of time.
So this is not a very efficient way of doing things.
So the Ocsp protocol was released to basically prove to be an alternate to CRL.
So again, the Ocsp stands for Online Certificate Status Protocol is basically an internet protocol
used for obtaining the revocation status of a 6.509 certificate.
So the goal of both CRL and the Ocsp are the same.
So let's look into the working of Ocsp.
So you have the client here.
Client basically connects to a website to perform the SSL, TLS handshake.
So this website basically gives the server certificate back to the client.
So now instead of client downloading or exploring the CRL, what it basically does, it contacts the
Ocsp server.
So this server certificate would also have the Ocsp server URL.
So basically this client will connect to this URL and it will verify whether this server certificate
is revoked or not.
And this ocsp server, which is managed by the CA, it will send a success or failed response.
If it is a success response, that means the certificate is perfectly fine.
If it is a field response, that means the certificate is revoked.
So now the entire aspect of checking the certificate is managed by the Ocsp server, which is typically
handled by the certificate authority.
So this is one of the quick ways in which you can go ahead and check for the revocation status.
So let me also show you this.
So let's open up Digitalocean certificate.
We'll go to extensions only now within the authority information access.
So this is one of the extensions.
So let me just open this up.
So this is the authority information access.
Within here you have access method, which is online certificate status protocol, and essentially you
have the URL here.
So before we conclude, let me also show you one more thing.
So when you go to options.
So this is a browser option.
If you go into privacy and security within the certificate, you see you have an option which is query
ocsp responder servers to confirm the current validity of certificates.
And this is important because nowadays you will see that the certificates which are being sent to the
client, in our case it would be browser.
So that certificate has the ocsp URL.
So it is important that the browser verifies with those URL, which are also referred as the Ocsp responder
to verify whether the certificate is revoked or not.
So that's the high level overview about both the certificate revocation lists and the Ocsp protocol.
I hope you understood at a high level overview about the revocation methods.