如何处理根证书的吊销？
撤销证书的原因有多种，最常见的原因是私钥的泄露。
我的问题是：
如果需要吊销证书颁发机构的证书会怎样？
这是否意味着它所签署的所有证书都应被视为已撤销？
这似乎是合理的，因为 CA 将颁发新证书，从而获得新的密钥对。
另一方面，撤销和重新颁发特定 CA 迄今为止已颁发的数百个证书的流程是什么？
我对吊销 CA 证书的后果感到困惑。
有人可以详细说明一下吗？
There are several reasons to revoke a certificate, the most popular one being compromise of the private key.
My question is:
What happens if there is a need to revoke the certificate of a certificate authority?
Does this mean that all the certificates it has signed should be considered revoked?
This seems reasonable, since the CA will be issued a new certificate hence a new key-pair.
On the other hand, what would be the process to revoke and reissue possibly hundreds of certificates the specific CA has already issued so far?
I am confused on the consequences of revoking a CA certificate.
Could someone please elaborate on this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您无法撤销受信任的（例如根 CA）证书，因为它是由 CA 自签名的，因此没有可用于验证 CRL 的受信任机制。如果根 CA 受到损害，那就非常糟糕了:-)。您必须手动从商店中删除 CA（或者，如果这些根证书是这些发行版的一部分，则这可能会通过浏览器或操作系统更新而发生）。
撤销其证书由根 CA 之一颁发的 CA 意味着该 CA 颁发的所有证书都不再有效。这种情况发生在路径处理期间，我们从尝试验证的证书开始，然后构建一条一直到受信任根的路径。该路径中的每个证书都应检查其各种路径约束，并且应使用 CRL（或其他机制）来确定它们是否已被撤销。如果任何证书失败，则整个路径被视为无效。
所以简短的回答是，是的。如果 CA 证书被吊销，则其颁发的所有证书（等等）都应被视为无效。
You can't revoke a trusted (e.g. Root CA) certificate, because it is self-signed by the CA and therefore there is no trusted mechanism by which to verify a CRL. If a root CA is compromised it is very bad :-). You have to manually remove the CA from your store (or this can happen by browser or OS updates if those root certs were part of those distributions).
Revoking a CA whose certificate was issued by one of the root CAs means that all the certificates that CA has issued are no longer valid. This happens during path processing, we start at the certificate we are trying to verify and then build a path all the way to a trusted root. Each certificate in that path should have their various path constraints checked, and a CRL (or other mechanism) should be used to determine whether they have been revoked. If any certificate fails then the whole path is considered invalid.
So the short answer is, yes. If the CA certificate is revoked, all certificates it issued (and so on down the path) should be considered invalid.
撤销证书的含义如下：“虽然该证书的内容看起来不错，但不应使用该证书”。这是一种“取消”证书上的加密签名的方法。
在使用证书之前（即使用证书中包含的公钥，例如作为 SSL 连接的一部分），必须验证证书，这意味着必须相对于证书中包含的公钥来验证证书上的签名。 CA 证书。这意味着使用 CA 证书，因此该证书上的签名也必须经过验证，依此类推，直到“根 CA”，也称为“信任锚” ”，假设始终经过验证（它在进行验证的任何软件中都是硬编码的）。
如果 CA 证书被吊销，则该证书将无法使用（这就是吊销证书的目的：使其不再使用）。特别是，证书验证不应再使用该 CA 证书。 CA 颁发的证书不会被撤销：可能，它们可以用包含相同密钥的另一个 CA 证书进行验证：CA 证书与任何其他证书一样，它将名称与公钥绑定；没有什么可以阻止断言绑定的多个不同证书的存在，这是“桥CA”情况下的正常情况（主要用于使某些证书可以相对于多个信任锚进行验证）。当然，如果 CA 证书因 CA 私钥被盗而被撤销，那么明智的做法是撤销颁发给所有的证书> 该 CA 以及该 CA 颁发的证书将不再能够被任何人验证。
因此，总而言之，吊销 CA 证书并不会吊销该 CA 颁发的所有证书，但会阻止通过该 CA 验证这些证书。
Revoking a certificate means the following: "although the contents of that certificate look fine, the certificate should not be used". It is a way to "cancel" the cryptographic signature on the certificate.
Before using a certificate (i.e. using the public key contained in the certificate, for instance as part of a SSL connection), the certificate must be validated, which means that the signature on the certificate must be verified relatively to the public key contained in a CA certificate. This implies using the CA certificate, so the signature on that certificate must also be verified, and so on, up to a "root CA", also known as "trust anchor", which is assumed to be always verified (it is hardcoded in whatever software is doing the verification).
If a CA certificate is revoked then it cannot be used (that's the point of revoking a certificate: so that it is not used anymore). In particular, certificate validation should not be able to use that CA certificate anymore. The certificates which that CA issued are not revoked: possibly, they may be verifiable with another CA certificate which contains the same key: a CA certificate is like any other certificate, it binds a name with a public key; nothing prevents the existence of several distinct certificates which assert that binding, and this is a normal situation in the case of "bridge CA" (mostly used so that some certificates may be verified relatively to several trust anchors). Of course, if the CA certificate is revoked because the CA private key was stolen, then the sensible course of action is to revoke all certificates issued to that CA, and the certificates issued by that CA will be no longer verifiable by anybody.
So, to sum up, revoking a CA certificate does not revoke all certificates issued by that CA, but it prevents verifying those certificates through that CA.
不会。如果 CA 证书被吊销，则其颁发的证书不应再被视为“已签名”。
No. If the CA certificate is revoked, it's issued certificates should no longer be considered 'signed'.