bugGNU Wget - Bugs: bug #43501, certificate revocation is not...

 
 

bug #43501: certificate revocation is not checked

Submitted by:  Vincent Lefèvre <vinc17>
Submitted on:  Thu 30 Oct 2014 02:10:32 AM UTC  
 
Category: Protocol IssueSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Closed
Release: NoneOperating System: GNU/Linux
Reproducibility: NoneFixed Release: None
Planned Release: NoneRegression: No
Work Required: NonePatch Included: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 11 Nov 2014 02:21:28 PM UTC, comment #1:

Thanks for pointing this out.

I just pushed the new feature --crl-file so that you can specify a CRL (Certificate Revocation List) for Wget. This is for GnuTLS only so far (we are still discussing if OpenSSL supports is being dropped).

CRLs do not scale well and OCSP has some privacy and SPOF issues.
OCSP Stapling is not yet available on all servers.

Very good explanations are found here
https://www.grc.com/revocation/ocsp-must-staple.htm

I close this bug.
Feel free to open new issues (maybe more specific), e.g. regarding OCSP implementation or the like.

Tim Ruehsen <rockdaboot>
Project Administrator
Thu 30 Oct 2014 02:10:32 AM UTC, original submission:

Certificate revocation is not checked. This can currently be seen on:

https://revoked.grc.com/
https://www.vinc17.net:4434/

Without certificate revocation checking, security is very low if the private key for some site has been compromised.

Vincent Lefèvre <vinc17>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rockdaboot (Posted a comment)
  • -unavailable- added by vinc17 (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 11 Nov 2014 02:21:28 PM UTCrockdabootStatusNone=>Fixed
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1