> -----Original Message----- > From: Walter H. >> Eisenacher, Patrick wrote: > >> -----Original Message----- > >> From: Jakob Bohm >> > > As I said before, there's no pki-inherent mechanism to revoke a self signed >> certificate other than to remove it from your truststore. > > not really; a CA that has to revoke one of their root cert. - these are > always self signed - uses a cert that comes from another root cert., or > this root cert itself to sign the CRL where it revokes the compromised > root cert; > doing so has a total different quality: the CA can't remove their > compromised root cert from the trusted cert store of your system, but > with the CRL they can tell your system, not to trust any cert that was > signed by the compromised root cert;
This is not possible according to PKIX. RFC5280 states "The trust anchor for the certification path [of the crl] MUST be the same as the trust anchor used to validate the target certificate." Patrick Eisenacher :��I"Ϯ��r�m���� (����Z+�K�+����1���x��h����[�z�(����Z+���f�y�������f���h��)z{,���