Improper Check for Certificate Revocation
This vulnerability occurs when an application fails to properly verify whether a security certificate has been revoked, potentially allowing it to accept and use a compromised or untrustworthy certificate.
Failing to check certificate revocation is a critical security gap, more severe than other certificate errors. When a certificate is revoked, it's almost always because the associated private key has been exposed or the issuing authority no longer trusts it—meaning any system still using that certificate is likely compromised. Legitimate services should never operate with a revoked certificate unless they have a serious configuration or synchronization problem. For developers, this means your application could mistakenly trust a malicious actor impersonating a legitimate server. To prevent this, always implement and test proper revocation checking mechanisms like CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol) in your TLS/SSL handshake logic, and ensure these checks cannot be bypassed by network errors or performance shortcuts.
Impact: Gain Privileges or Assume Identity
Trust may be assigned to an entity who is not who it claims to be.
Impact: Other
Data from an untrusted (and possibly malicious) source may be integrated.
Impact: Read Application Data
Data may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.
ID : DX-124
The following OpenSSL code ensures that there is a certificate before continuing execution.Code Example:
c// got a certificate, do secret things*
Medium
- CLASP