[15205] in cryptography@c2.net mail archive
RE: Verisign CRL single point of failure
daemon@ATHENA.MIT.EDU (dave kleiman)
Wed Mar 31 22:43:03 2004
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
From: "dave kleiman" <davek@netmedic.net>
To: "'Rich Salz'" <rsalz@datapower.com>
Cc: <cryptography@metzdowd.com>
Date: Fri, 9 Jan 2004 15:26:42 -0500
In-Reply-To: <3FFEFBBE.7050603@datapower.com>
>>I don't think you understood my question. Why is crl.verisign.com
>>getting overloaded *now.* What does the expiration of one of their CA
>>certificates have to do with it? Once you see that a cert has expired,
>>there's no need whatsoever to go look at the CRL. The point of a CRL is
>>to revoke certificates prior to their expiration.
You are correct I did miss your point in haste.
I cannot answer that, but I can tell you that disabling the function or
uninstalling NAV that has CRL function, fixes the problem immediately.
And if you watch your firewall as the clients open a file that requests a
virus scan they all try to hit crl.verisign.com. This has been happening
since the 7th when that cert expired.
DK
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com