RE: Online Certificate Revocation Protocol

[Hal Lockhart <[e-mail]>]

> Does this relate to why the "emergency CRL" published after the bogus 
> Microsoft code-signing certs were issued was not a "real CRL"?  I 
> understood that Microsoft supported one form of "CRL 
> mechanism" while they 
> routinely employed certificates incompatible with that 
> mechanism, and that 
> was the reason they cold not "just revoke" the (bad) 
> certificates that were 
> issued.

According to this:

http://amug.org/~glguerin/opinion/revocation.html

the problem is that Microsoft software will only find CRLs specified in the
CRL Distribution Point extension in the certificate. Verisign does not use
this method. Since the use of this field is optional and Versign has been
operating since before the field was even defined, it is debatable who is to
blame for this situation.

Apparently Micorsoft's "fix" was to hotwire a special CRL, containing just
these two certs into their products.

Hal