[15205] in cryptography@c2.net mail archive

home help back first fref pref prev next nref lref last post

RE: Verisign CRL single point of failure

daemon@ATHENA.MIT.EDU (dave kleiman)
Wed Mar 31 22:43:03 2004

X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
From: "dave kleiman" <davek@netmedic.net>
To: "'Rich Salz'" <rsalz@datapower.com>
Cc: <cryptography@metzdowd.com>
Date: Fri, 9 Jan 2004 15:26:42 -0500
In-Reply-To: <3FFEFBBE.7050603@datapower.com>


>>I don't think you understood my question.  Why is crl.verisign.com 
>>getting overloaded *now.*  What does the expiration of one of their CA 
>>certificates have to do with it?  Once you see that a cert has expired, 
>>there's no need whatsoever to go look at the CRL.  The point of a CRL is 
>>to revoke certificates prior to their expiration.
	
You are correct I did miss your point in haste. 
I cannot answer that, but I can tell you that disabling the function or
uninstalling NAV that has CRL function, fixes the problem immediately.
And if you watch your firewall as the clients open a file that requests a
virus scan they all try to hit crl.verisign.com. This has been happening
since the 7th when that cert expired.
DK


---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com

home help back first fref pref prev next nref lref last post