Hey, everyone.
And welcome back.
Now, in today's video, we will be discussing about revoking the SSL, TLS certificates and its associated
very important pointers.
Now, one very important part to remember is that the secrecy of a private communication is dependent
on the private key.
Now, this specifically applies to the asymmetric key encryption.
Now, if the web server is compromised and the private key is stolen, then attacker can decrypt the
communication.
So basically a web server has the private key which is stored.
And if web server gets compromised because there have been a lot of cases where this has happened.
So an attacker can easily steal the private key and decrypt the previous communication which he might
have captured.
So what happens when your private key is stolen and your web server is compromised?
Then, in such cases, revocation of the certificate is recommended.
So what happens in revocation of certificate?
You revoke the certificate, you create a new certificate with a new private key, and you implement
the new certificate and the new private key in a secured web server.
So I'm in my Nginx server right now and just to verify if things are working as expected, you will
see that we have a Https Labs internal.com which is working perfectly.
So let's say that this server is compromised and the private key is stolen by the attacker.
So now as a security person or as a DevOps or as a QA, now you know that there has been a compromise
and the certificate needs to be revoked.
So we had basically brought a certificate from let's encrypt.
So let's look into how we can revoke the certificate based on let's encrypt.
So basically the certificate revocation is typically done by the certificate authority.
So in our case, we'll be using the let's encrypt tool to revoke the certificate.
So let's use CERT bot.
I'll say revoke.
Then we'll have to supply the cert path as well as the key path.
So these are the two things which are required.
So in order to get that, let's open up the nginx.conf here.
So you have the certificate path as well as the key path.
So let's put it here.
So I'll copy the certificate path.
And I'll also copy the key path.
All right, So let's run this command.
All right.
So let's quickly verify whether we had pasted things correctly.
All right.
We had not done it.
So let's copy the key part and let me paste it.
All right.
So again, it is starting a new Https connection with their API server for the certificate revocation.
So it says, Would you like to delete the certificate?
Let me just put it as no for the time being.
And now it says that congratulations, you have successfully revoked the certificate.
So the certificate is revoked, although it is not deleted from the web browser, but it has been revoked.
Now we already know about the CRL as well as the Ocsp.
Now certain providers like let's encrypt, for example, let's encrypt does not really support Crls.
However, you have Digicert which supports both CRL as well as Ocsp.
So again, it depends upon the provider from which you got the certificates from.
So once the certificate has been revoked, let's put the labs internal.com within the browser.
So as soon as I put it, you see now it says that secure connection failed.
And it says that this specific certificate has been revoked.
So this is as expected.
All right.
So with Firefox, things seems to be working perfectly well.
Now let's try it with Google Chrome.
So within Google Chrome, let's put the name.
And you see it did not really show that the certificate has been revoked.
So in order to verify, once again, let's open up Ignito mode.
I'll put it here.
And even now it is not really showing that the certificate is revoked.
Let's double check.
Let's retry.
And it does not seem to be working.
So to also quickly verify, let's open up SSL labs and I'll do a SSL server test.
Now let's put it as Https Labs internal.com.
So it is our time to be within the recent worst, but this is just for testing.
And now you see it is giving us an F, So why is it giving us an F?
It basically says that the server certificate is not trusted.
This is one of the primary reason it went to F.
So the revocation of certificate works perfectly well.
However, for Chrome, it does not seem to work.
So there are certain important pointers that you need to remember here.
So let's understand.
Now Firefox makes use of Ocsp so it is able to quickly verify whether the certificate is valid or it
is revoked.
Now Chrome does not make use of Ocsp.
Now Chrome even does not make use of CRL.
However, what Chrome does is that Chrome has its own methods for checking the revoked certificates
and it is called as the CRL sets.
So what CRL set is that it basically maintains its own list of crls, which it in turn collects from
various other certificate authorities.
So let's say that there are five certificate authorities.
Chrome collects the CRL from the five certificate authorities.
It combines all of them together in a mega CRL and then it adds it within the Google Chrome.
Now, there are certain advantages here.
So now one of the advantages is that browser doesn't really need to contact the certificate authority
itself and it can remove the performance and privacy overheads.
But there is a problem with this approach.
The problem is that first CRL set does not have 100% of the revoked certificates.
Again, they have some kind of algorithm, but it is not 100% of all the revoked certificates here.
Now the second problem here is that the CRL are not really updated instantaneously.
So if a certificate is revoked, you will still see Google Chrome to be working perfectly well because
it does not really make use of ocsp here.
Firefox makes use of ocsp so it immediately queries the responder associated with let's encrypt in our
case and it is able to figure it out that a certificate is revoked.
Google Chrome does not really does that.
So this is one of the reasons why you see that the revocation is broken and this is the common problem
across the Internet.
It's not just related to a specific, let's say, Nginx or Letsencrypt.
It is a common problem that you will have to face during the certificate revocation time.
Now, the problem why this happens is because all the browsers, they do not really follow a common
method.
So if a Firefox is making use of ocsp, Chrome does not really make use of ocsp at all.
So this is like every browser has a different way of doing things and this is the reason why you will
see a lot of issues specifically when you are revoking the certificate.
So make sure that if you are using the certificates, make sure that the web server is secured so that
the revocation does not really be a topic at all.
Now the second way is you can make use of services like AWS certificate manager.
So what happens in those services?
That AWS certificate manager itself manages the certificate and the private key.
You do not have access to the private key.
So now the compromise of your web server will not really lead to compromise of the private key.
So you do not really need to worry much about the revocation there.
So before we conclude, this is the Sets website.
So if you look over here, the Oxp and CRL checks are not generally performed by Chrome, and this is
one of the reasons why you will have quite good amount of issues.
Typically when you are revoking your certificates again, once your certificate is revoked and if it
comes within the CRL sets, there would be certain amount of time that it will take.
It is not instantaneous, so you will have to bear with that.
So that's the high level overview about the revocation of certificates and also some of the caveats
that you will have to face once your certificate is revoked.
So with this, we'll conclude this video.
I hope this video has been informative for you and look forward to see you in the next video.