Revocation of digital certificates: CRL, OCSP, OCSP stapling

[@johnhart6320]

As ALWAYS...your videos help me BIGTIME! Whenever I am in need of a CLEAR explanation on a technology that some other 'Off the Charts GEEK in the Weeds' tries to teach, I check and see if Sunny has a class to clear it up for me! Thanks Again Man!!

[@sunnyclassroom24]

Thank you, John, for saying nice things about my videos. You are welcome. I wish I would complete my whole series in this area (about 200 videos) soon.

[@michaeljimenez239]

Just want to say, i used some of your videos to pass my network plus and currently doing th same with security plus. I always find your explanations easier to understand than most other instructors. Thank you!

[@MohenjinAdventure]

I could not understand about CRL/OCSP/OSCP Stapling, but now I finally did. Thank you! You have been a great help!

[@lesleycouch9542]

I knew I could count on you to explain this concept clearly and concisely. I get it now! Thank you Sunny!

[@nattiyar614]

This is by far the best explanation ever! Thank you so much!!

[@scottbiggs8894]

Step 4, that all this happens "during the SSL/TLS handshake" was the puzzle piece I was missing. Thank you. And the music at end made me laugh. :)

[@sunnyclassroom24]

Thank you for watching!

[@mimi7132]

Exactly

[@miriyalajeevankumar5449]

The best content on this topic is your channel !!

[@chengluo5956]

Simple and clear, that's all I need. Thank you Sunny!

[@TheSukramb]

Truly awesome. Helps a lot because of your visualizations in addition to your explanation.

[@sunnyclassroom24]

Thank you for your time!

[@jaydawg91]

As always your videos are clear and provide accurate information. Thank you, Sunny.

[@techlearner4806]

Simple and easy language/demo used in video. All thanks to you.

[@nkanakaraj]

Awesome! This is the exact info I was looking for to troubleshoot an issue related to OSCP. Sunny! you very well explained CRL, OSCP, and OSCP-Stapling operations in a quick video. Thank you very much!

[@TheAhamedabdul]

Thanks a lot Sunny! this is very clear and useful.

[@poncho8887]

Thank you for your clear explanations for our understanding.

[@Drawmeafatcat]

crazy how complicated other people make this when you just explained it in 6 mins.

[@34521ful]

Hi Sunny, great video once again! I think one thing I'd add for future viewers is that another thing browsers like Firefox and Chrome do are just push a software update if a certificate must be revoked as soon as possible

[@sunnyclassroom24]

thanks a lot for your information. I appreciate it very much.

[@jilanishaik8791]

It's very nice explanation. Thanks Sunny

[@beepboop8250]

Excellent videos, very concise and easy to understand. Thank you

[@sunnyclassroom24]

you are welcome!

[@ayatarek6612]

Thank you so much this was very clear and helpful.

[@AmeenAltajer]

Clear explanation, thanks man!

[@marcosalameh8677]

As usual soooooooo amazing!!!!!!!!!!!!!!!!!!!!!

[@asoteico9528]

Greatly done Sunny...!!! 🥇🎖🏅

[@sonurocks341]

Great Videos. Very crisp explanation.

[@sunnyclassroom24]

Glad you liked it!

[@okbazoueghi6714]

Great explanation!

[@tim6925]

thank you, thats a very clear explanation.

[@johnnkoh2601]

you are really good at explaining things. Thank you very much

[@jasonhoi85]

thanks this is much clean then reading the text explaination

[@sunnyclassroom24]

Thank you for watching!

[@grahammattingley9784]

Very helpful information - keep up the good videos and the good work

[@sunnyclassroom24]

thanks a lot!

[@aziz421973]

Very useful information, thank you so much.

[@sunnyclassroom24]

You are welcome, Aziz.

[@jeremygunter9877]

Well done, thank you!

[@ravichanderkt326]

You're Gifted By God.

[@HughJass-313]

Bravo!! ❤❤

[@AyushmanAdhikary]

Great video. Thanks for the explanation.

[@ahmeddarwish3859]

very good teacher.Thanks

[@livestronger1981]

Great explanation

[@andreaszetea-ster900]

great work. Thank you

[@sunnyclassroom24]

Thanks

[@devendramhatre5007]

Nicely Explained.... thank you sir

[@sunnyclassroom24]

You are most welcome!

[@zowajoy7616]

You are awesome 🙏

[@sunnyclassroom24]

Thanks!

[@OmarJIBAR]

Beautiful 👌

[@fa307]

great video, would be great if you could update this and make a video about certificate transparency (CT Logs)! :)

[@mimi7132]

great explanation, thanks

[@dieglhix]

All clear, thanks Mr. Subscribing now.

[@sunnyclassroom24]

Thanks for the sub!

[@rajeshgeorge6093]

thanks very much

[@sunnyclassroom24]

You are so welcome!

[@kavi3841]

Thank you sir

[@sunnyclassroom24]

All the best

[@mofogie]

well what if a domain spoofer simply forges a certificate?

[@ameenasif]

So if an organization has issued certificates in thousands , and device1 comes with request , does webserver has stapled request for all thousand devices at that time , if its cached only on calls ? so when a signed response is received all it needs to do is verify certificate validity end date etc, no need to go to check revoked status as its trusted with cryptography i.e the signed response . is this right

[@sriksrik8184]

Hi Sunny, if the client from a ABC company domain accessing a website, how can it check the website certificates status from the ABC domains CA CRL list,,, does that mean that ABC domain CA will have constant updates, if so how,,,

[@iyam1513]

Thanks for your video, "OCSP stapling" is quite smart solution, but for how long does web server cache OCSP Response from CA? And for how long does the client (browser) consider that the response is still valid (I mean as for standards)? I think this is the point of "lag" between revocation and outdated signed OCSP Response from web server. So it is important to note.

[@deekusnotes3318]

Does it mean OCSP URLs no need to be added to firewall between client and server?

[@jibnathgautamhy1280]

Thank you verymuch

[@arber10]

Sunny, one more question: Which book(s) would you recommend for a deep dive in this topic? (I mean cryptography not just revocation.)

[@sunnyclassroom24]

It depends how deep do you want to go? If you are just for CompTIA security + , you can use Comptia security+ guide to network security fundamentals 6th edition or 5th edition (cheaper).

[@arber10]

Thank you. I will check this.

[@corolla1209]

Hi Sunny, will you talk about SCVP in the future videos?

[@greenboy7484]

hi sunny...can you explain how policy maping works in CA and sub-CA in another video?

[@sunnyclassroom24]

I put it on my to do list. Many thanks!

[@ishajain7020]

When certificates are stolen from CA, why those certificates need to be revoked. I mean we are already certificates, but harm stolen certificates will make.

[@sunnyclassroom24]

Browsers make sure that all certificates are valid. It is like someone stole your credit card, and you want to report to your credit card company to revoke it. Otherwise, the thief will use your credit card. The same thing.

[@RajivKumar-ee7xv]

@@sunnyclassroom24Here I have a question, Private key of stolen certificate is always with the owner for whom CA issued certificate. So other details are always public. What was stolen from CA for that particular certificate?

[@chadsexinton]

Yea but browser and other clients no longer check the crl or ocsp servers so revocation is useless .

[@richardturk7162]

Great explanation but I still have no idea what you are talking about.

[@DohertyMax]

Lopez Barbara Young Jessica White David

[@dr.r.aravindhanm.eph.d1046]

Very Good Explanation