4 ms·
Seems that Firefox skips revocation checks for CA certs [1]. [1] https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox https://wiki.mozilla.org/CA/Revocat
by crehn 7y ago
Seems that Firefox skips revocation checks for CA certs [1].
[1] https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox
- marcinzm 7y agoWhere does it say that? The link says they centrally manage revocations using OneCRL and then push a single revocation list to browsers (independent of browser updates). Which means they can revoke any certificate they want using that mechanism.
- crehn 7y agoAh, you're correct. Seems they skip CA CRL/OCSP in favor of their own CRL. Thanks for the correction.