Subject: RE: signed e-mail

From: Stefan Kotes <[email-masked]>
Date: Tue, 20 Nov 2001 17:33:09 -0800

Rob,
I just wanted to inform you about our product - ValiCert Desktop
Validator - that may solve your problems with certificate validation on
Windows platform. The Desktop Validator provides validation capability
for client applications. It works with Microsoft Outlook, Outlook
Express, Microsoft Internet Explorer, and Pure Edge. Built into the
functionality is the capability of providing validation checking for the
Microsoft Windows Address Book, which stores information such as e-mail
addresses and digital certificates. The Desktop Validator lets you check
the status of digital certificates used to sign S/MIME E-mail. It also
allows you to check the status of digital certificates present in the
various certificate data stores of a computer running Windows NT,
Windows 95/98, or Windows 2000. The product can be configured to use
plain CRL validation as well as certificate validation based on OCSP or
SCVP protocol.

Let me know if you need any further information.

Regards,
Stefan Kotes
Core Technology 
ValiCert

-----Original Message-----
From: Rob G Weemhoff [mailto:[email-masked]]
Sent: Saturday, November 17, 2001 11:03 AM
To: [email-masked]
Subject: Re: signed e-mail

On Tuesday, 13-11-2001 at 12:00 CST, Bob Jueneman<[email-masked]> 
wrote:
> [...]  When I tried to validate the CRL, GroupWise failed to 
> retrieve it, complaining about an "unknown error".  So I copied the
URL 
form 
> the certificate and pasted it into the address line of IE5.  It asked
me 

> whether to save the file or execute it remotely, so I held my breath
and 
said 
> execute remotely, and down it came, just fine. 

I observed that when I save the CRL file to disk and thereafter install 
it, it says the import is successful, but in fact id did not overwrite
the 
existing CRL as I noticed with the certificate manager in MMC. 
When I do, like you, execute remotely it is imported correctly, and also

if I first delete the old CRL.

But, this locally stored CRL appears not to be used at all.

> [...] but this may be due to some kind of an interaction with the 
> personal firewall I run (Zone Alarm Pro).  [...]

I use Symantic Desktop Firewall, and I am unsure about its rules,
because 
it silently blocks things, but I have from the logs no indication of any

inference.

> [...]

I am very happy with your long expose, because this discussion is
exactly 
what I hoped for.

One of my observations: There is no difference in Outlook
Express/Windows 
2000 SP2 reporting the validity of my Equifax and my Verisign
certificate, 
while the Verisign intermediate CA contains a CRL distribution point and

(as you observed) the Equifax CA does not.
The revocation status is: The digital ID has not been revoked or 
revocation information for this certificate could not be determined.
I do not know if there can be an unconditionally valid status but I know

there is no unconditional status when it can not get the CRL because I 
deluded Outlook in thinking it was connected while I switched off my 
socksification so both CRL's positively could not be accessed.
So now I know that Outlook Express can not access the CRL's, but I do
not 
know why.

B.t.w. I am preparing a revoked Equifax certificate for testing
purposes. 
If someone wants to receive a message intentionally signed with a
revoked 
certificate, just ask directly, and I will sent a message when I have
seen 
the certificate in the CRL.

----
Regards,
Ing. Rob G. WEEMHOFF 
Senior Consulting IT-Architect 
IBM Security and Privacy Services (EMEA)
Tel:        +31(0)20 513  9102 
Mobile: +31(0)653263269

E-mail: [email-masked] 
Fax: +31(0)33 2470578
Computerweg 8
3821 AB  Amersfoort
The Netherlands

http://w3.ibm.com/services/bisglobal/solutions/security.html
news://forums.ibm.com/forums.security.community
See you at Sametime (http://w3.ibm.com/team/im/)

---

From: Aram Perez <[email-masked]>
Date: Tue, 20 Nov 2001 23:02:22 -0800

> plain CRL validation as well as certificate validation based on OCSP or
As Stephen Kent recently pointed out, there are a few of use that don't 
always use Windows based PCs. How about support for Macintosh and *nix?

Regards,
Aram Perez

[snip]