[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <op.2kiw1hz3n7mcit@hodgins.homeip.net>
Date: Tue, 12 Mar 2024 09:57:07 -0400
From: "David W. Hodgins" <davidwhodgins@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Certificate policy: OCSP becomes optional and CRLs
mandatory for public CAs on Friday
On Tue, 12 Mar 2024 00:28:49 -0400, Demi Marie Obenour <demi@...isiblethingslab.com> wrote:
<snip>
> macOS, iOS, Windows, and possibly Android have system certificate
> verifiers that can handle this easily. For desktop and server Linux,
> should a CRLite package be included in system package managers? Would
> it be feasible for WebPKI and {Open,Boring,Libre}SSL to handle CRLite,
> or does this mean that NSS should be used for certificate verification?
Isn't that the purpose of the crlutil command in the nss package?
From "man 1 crlutil" ...
DESCRIPTION
The Certificate Revocation List (CRL) Management Tool, crlutil, is a command-line utility that can list, generate, modify, or delete CRLs within the NSS security database file(s) and list, create,
modify or delete certificates entries in a particular CRL.
https://manpages.org/crlutil
Regards, Dave Hodgins
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
