mailing list archives
Re: Windows doesn't verify digital signature of CRL files
From: Thomas Walpuski <thomas-bugtraq () unproved org>
Date: Tue, 10 Aug 2004 07:32:40 +0000
* Faro Poplar wrote:
Has anyone noticed that Windows doesn't verify the digital signature
of CRL files (*.crl).
Yes, I noticed that about 2 years ago. IMO this is no security issue.
CRLs are retrieved from the certificate store via CertGetCRLFromStore.
Sane use of CertGetCRLFromStore makes sure only properly signed CRLs are