Slightly offtopic. can anyone explain how DigiNotar revoking the wrong certificate works?
As per my understanding the browser simply trusts all certificates issued by a trusted issuing authority, so how would you revoke a single certificate?
As per my understanding the browser simply trusts all certificates issued by a trusted issuing authority, so how would you revoke a single certificate?
1. You add the certificate to your Certificate Revocation List.
2. You pretend that people will check the CRL before trusting the forged certificate, ignoring the fact that some clients only check for updates to the CRL periodically and most don't check CRLs at all.
In short, it doesn't really work.