When a certificates checks the CRL?

Question

Hello all.

I have signed my applications with a Code Signing Certificate for a long time. Still, since the last renew (SHA256), I noticed every time I start my application a request to the corresponding CRL (certificate revocation list) is made.

Nothing strange but this leads to several timeouts before the application is ready because typically it's installed on servers without internet access (I know: I could disable the check, black-hole it in hosts file, ...)

With another certificate (older, SHA1) the application starts immediately, and no requests is made to CRL

I didn't found any documentation about differences in CRL with different types of certificates...

Someone is so kind as to know some behaviour differences between the two cases?

Thanks.

Enrico

Answer 1

Hello @Enrico Zogno ,

Thank you for posting here.

To better understand our question, please confirm the information below:

1.Do you mean the same application on the same machine or the same application on different machine?

2.Are the last renew (SHA256) and another certificate (older, SHA1) issued by the same CA server or different CAs servers?

3.If the CA issued last renew (SHA256) is your internal CA server or third-part CA server?

4.If the CA issued another certificate (older, SHA1) is your internal CA server or third-part CA server?

5.We can check what kind CRL we can see about the two certificates (ldap，http or file) ?

For example:

6.We can check if we can access the CRL locations in step 5.

Best Regards,
Daisy Zhou

Answer 2

Hi,

It seems that the application needs internet connection to check the one of the CRL URL mentioned on new certificate. When you install the new certificate , the application needs to check CRL to validate new certificate, then it will be kept in the cache.
The application start immediately with the old certificate SHA1, because it has already t in the cache.

Please don't forget to mark this reply as answer if it help you to fix your issue