Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm drawing up some documentation for users with the intent on educating them on certificate revocation. I would like to include screen shots of browsers to demonstrate the user experience when encountering a revoked cert. The revocation can occur via either OCSP or CRL.

I've tried digging around CRLs, but they list the serial number of a certificate and don't provide a URL for me to try connecting.

Could someone provide a URL to a live site with a non-self-signed but revoked cert? Or perhaps there's a way to look up certs in a CRL and cross reference them to a URL?

share|improve this question
add comment

2 Answers

The revoked certificate of Mozilla Addons and its corresponding keyfiles are available in the wild. So you could test it yourself. For this experiment, you need to point the addons.mozilla.org domain to the IP address of your test server.

The private key file is 27 lines long and can be found at http://erratasec.blogspot.com/2011/03/verifying-comodo-hackers-key.html. The certifate can be downloaded from http://www.multiupload.com/J9I8NFWPT0.

If you're running a server on your local machine (localhost), change the hosts file, so addons.mozilla.org points to 127.0.0.1. Use the key and certificate files above for your server.

Instructions using the openssl command on Ubuntu/Linux:

  1. Put the keyfile in moz.pem and the certificate in moz.crt.
  2. Add 127.0.0.1 addons.mozilla.org to /etc/hosts
  3. Start a HTTPS server using the openssl s_server command:

    sudo openssl s_server -cert moz.crt -key moz.pem -accept 443 -www
    
  4. Go to your browser and take screenshots, copy text, etc.
  5. When done, remove the entry from /etc/hosts.

An (tested) Linux shell script can be found at http://pastebin.com/DRE32SFR. Download it and execute it as root (required for binding to port 443 and editing /etc/hosts)

The next screenshots below are taken on Ubuntu 10.10 in Mozilla Firefox (without the patch) using the above instructions.

Firefox with CRL's enabled gives a warning: Firefox rejects the certificate using CRL's

Opening Firefox with CRL checking disabled to simulate an unreachable CRL server opens the page without a gasp: Firefox opens the page successfully without error messages

share|improve this answer
add comment

I have just tried to log-in to this website for a legitimate, large British insurance company and their certificate is invalid:

http://www.axa.co.uk/insurance/myaxaspace (12:02 GMT, 10th April 2011)

Firefox says that the certificate is "not trusted because no issuer chain was provided", but I'm not sure if this is what you're after.

share|improve this answer
    
This seems to have been fixed now. –  John Catterfeld Apr 12 '11 at 14:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.