bugGNU Wget - Bugs: bug #43501, certificate revocation is not...

 
 

bug #43501: certificate revocation is not checked

Submitter:  Vincent Lefèvre <vinc17>
Submitted:  Thu 30 Oct 2014 02:10:32 AM UTC
   
 
Category:  Protocol Issue Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  None Operating System:  GNU/Linux
Reproducibility:  None Fixed Release:  None
Planned Release:  None Regression:  No
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 11 Nov 2014 02:21:28 PM UTC, comment #1: 

Thanks for pointing this out.

I just pushed the new feature --crl-file so that you can specify a CRL (Certificate Revocation List) for Wget. This is for GnuTLS only so far (we are still discussing if OpenSSL supports is being dropped).

CRLs do not scale well and OCSP has some privacy and SPOF issues.
OCSP Stapling is not yet available on all servers.

Very good explanations are found here
https://www.grc.com/revocation/ocsp-must-staple.htm

I close this bug.
Feel free to open new issues (maybe more specific), e.g. regarding OCSP implementation or the like.

Tim Ruehsen <rockdaboot>
Group administrator
Thu 30 Oct 2014 02:10:32 AM UTC, original submission:  

Certificate revocation is not checked. This can currently be seen on:

  https://revoked.grc.com/
  https://www.vinc17.net:4434/

Without certificate revocation checking, security is very low if the private key for some site has been compromised.

Vincent Lefèvre <vinc17>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rockdaboot (Posted a comment)
  • -email is unavailable- added by vinc17 (Submitted the item)
  •  

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-11-11 rockdaboot StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code