2 ms·
Cert revocation for the web is broken, which is why there's been so much emphasis on lifetime. Revocation checks are a privacy leak and reliability degradation
by will4274 7y ago
Cert revocation for the web is broken, which is why there's been so much emphasis on lifetime. Revocation checks are a privacy leak and reliability degradation and DoS vector, unless you use something like OCSP stapling, which fairly few sites do.
- dochtman 7y agoMozilla is starting to do CRLite, which should be an improvement here: https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...