SSL Certificate Revocation | The Backend Engineering Show

Certificates contain useful metadata including the public key, domain name, signature, etc. However, the private key can be leaked which causes the certificate to be invalid/dangerous to keep around. In that particular situation, we need a mechanism to revoke certificates and that is what I’m going to discuss in this show.

0:00 Intro
0:30 Why Certificates
12:00 Certificates can go bad
14:50 Certificate Revocation Lists (CRLs)
18:30 OCSP (Online Certificate Status Protocol)
20:40 OCSP Stapling
24:30 Best certificates are short
26:30 Summary

Become a Member on YouTube

🔥 Members Only Content

Support my work on PayPal

🧑‍🏫 Courses I Teach

🏭 Backend Engineering Videos in Order

💾 Database Engineering Videos

🎙️Listen to the Backend Engineering Podcast

Gears and tools used on the Channel (affiliates)

🖼️ Slides and Thumbnail Design
Canva

🎙️ Mic Gear
Shure SM7B Cardioid Dynamic Microphone

Cloudlifter

XLR cables

Focusrite Audio Interface

📷 Camera Gear
Canon M50 Mark II

Micro HDMI to HDMI

Video capture card

AC Wall for constant power

Stay Awesome,
Hussein

[shiewhun]

Your channel actual gives me joy. I can always expect to click on the next video and have my mind wowed and knowledge base expanded. There's just a lot about computer science I didn't know I didn't know, and this is just stuff related to the internet.

[smileyface]

Your content is so satisfying to watch, thank you

[XSilver_WaterX]

This is a great listen. While sad that these certificates and server speeds CAN be forged to attack low paying or free-ium customer, dishonoring senior members with these bad habits. The internet isn't old enough to understand of proper-lock pings while any basic tech-head can change the IP and Speed-Id to 1 intead of 8.

[supersu]

Video quality is drastically improved today whats new here?

[vasachisenjubean]

Fantastic explanation. I loved this channel.

[deekusnotes]

Awesome as usual. I have a question. Does certificate revocation check need to be enforced in client-side code? or is it taken care by default SDK?

[TheOrioNation]

Great content as usual!
Something feels wrong about the framerate though...

[vimukthirandika]

Could you please make a video about certificates for backend engineers?

[AkshayKaushik]

Hey Hussein, My backend take long to respond due to tcp+ssl. What we can do to improve connection response time of server. It took more than 200ms just to connect to server. Note: i am using cloudflare to reduce dns time but it didn't work on first request.

[davidong]

In the same way that certificates can be faulty, can OCSP stapling be faulty too? Furthermore, can an OCSP server hosted by the service give a false authentication as a malicious attack?

[spencers]

is it possible for certificates to have multiple certificate authority signatures to be valid (s.t. the compromise of one CA doesn't affect all certificates).

[RyanBess]

Do some research on the process for getting a root cert added automagically with windows. Roots certs are not there in current Windows OS's. They were back in the XP days but since i think windows 7 there's a new process. but yes, if someone adds a cert manually into the root cert store, game over, your OS now trust that cert.

[bashardlaleh]

How can you disable OCSP on your server if clients asks for it !

[autohmae]

7:10 DNSSEC DANE TLSA Usage 3 record of course, right ?
Darn, guessed wrong again. ;-)
Edit: I know the video has gotten pretty long, but something that was missing: Certificate Transparency.

[majidaljishi]

Can you talk about SSL pinning certificate renewal strategy on Client and Server?