mailing list archives
Windows doesn't verify digital signature of CRL files
From: Faro Poplar <faropoplar () yahoo com>
Date: 9 Aug 2004 14:31:38 -0000
Has anyone noticed that Windows doesn't verify the digital signature of CRL files (*.crl). After you modify the
content of a CRL file, Windows doesn't tell you it has been tampered.
I found this problem under Windows2000/XP. Did Microsoft plan to do so or is it an OS bug?
You can test this with the following steps:
1) download a CRL file from any CA to your Windows machine, eg. http://crl.verisign.com/RSASecureServer.crl
2) double click the file "RSASecureServer.crl" in Windows Explorer, open the "Revoked List" tab. Remember the serial
number of any revoked certificate, for example, the serial number of the first cert in the list is:
" 0101 CD5F A174 D413 BE0F 666A 034A 004A "
3) close the opened file "RSASecureServer.crl"
4) Re-open the file with a Hex editor (eg.ultraedit), and find the Hex String " 0101 CD5F......", modify it and
save the changes.
5) double-click the file in Windows Explorer, switch to the "Revoked List" tab, and you will find the changes have
been there and Windows didn't do the signature verification work!
Now the cert "0101 CD5F ..." is no longer "REVOKED" if a relying-party would make a CRL-based certificate status
But if you do the same thing with a certificate file(*.crt, *.cer),Windows will tell you the certificate has an
Any comments are welcome.
- Windows doesn't verify digital signature of CRL files Faro Poplar (Aug 09)