4 ms·
Not at all. Revoke trust in the signing authority and all it's certificates turn invalid the second that change hits. Update your OS's trust store to not trust
by daenney 9y ago
Not at all. Revoke trust in the signing authority and all it's certificates turn invalid the second that change hits. Update your OS's trust store to not trust Comodo anymore and you'll see the effects immediately in IE/Edge on Windows or Safari and Chrome on macOS (Firefox still ships its own CA bundle).
It's just that when trust has been revoked in CAs recently, it's been done in a more gradual fashion to not hurt customers too much and give them time to migrate. After all, it's not the customer's fault the CA went rogue. This usually starts with not accepting certificates past a certain date but still validating previously issued ones, until sometime 6 months to a year later they're completely distrusted.
- wbl 9y agoWhich is exactly what I said above could be done.
- daenney 9y agoThat's not at all what you said. What I replied to is where you literally said: > Revocation can be done only for new certs. That's not true. The "newness" of a cert or a CA has absolutely nothing to do with how, if and when it can be revoked.