Is revoking an expired certificate a good approach?
An expired certificate is considered an invalid certificate, but it is possible to revoke it. Since it is possible to revoke it, it should be a valid approach by the CA.
Doesn't the CA consider if it is revoked or not and how would it affect the way the certificate is used.
It is a bad idea. No CA do this
An expired certificate will be rejected in general. A digital-signature signature will be verified as invalid using an expired certificate. Browsers reject SSL connections to sites with expired certificates. There is no need of any additional validation
In fact, you will cause an inconsistency with existent signatures. To preserve signatures along certificate expiration time, they are protected with a timestamp. When the certificate of the timestamp is close to expire, an additional timestamp can be issued. Long term signature format AdES also embed the revocation evidences of used certificates.
Revoking an expired certificate means those signatures are valid, but the status of the certificate at CA would be not valid. It has no sense.
From the point of view of the CA, It is a waste of resources. Think in a 20 years old CA with millions of expired certificates in revoked state. It will need an incredible large CRL file( revocation list) to serve and OCSP Services ( online check status) to maintain
Clients are expected to reject expired certificates. If a client, for whatever reason, accepts an expired certificate, and then checks to see if the certificate has been explicitly revoked, it will most likely be disappointed. From RFC 5280 ("Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile"):
A complete CRL lists all unexpired certificates, within its scope, that have been revoked for one of the revocation reasons covered by the CRL scope. A full and complete CRL lists all unexpired certificates issued by a CA that have been revoked for any reason.
That is, the CRL will not list any expired certificates.
The InCommon/Comodo CA will not allow you to revoke an already-expired certificate; I suspect that other CA's are set up similarly.
By default, CRLs do not contain information about revoked expired certificates. The server can include revoked expired certificates by enabling that option for the issuing point. If expired certificates are included, information about revoked certificates is not removed from the CRL when the certificate expires. If expired certificates are not included, information about revoked certificates is removed from the CRL when the certificate expires.
© 2022 - 2024 — McMap. All rights reserved.
