3 ms·
OCSP stapling may be what you're looking for. The certificate stays the same, but an additional short-lived signature indicating that it wasn't revoked yet is a
by tgsovlerkhgsel 6y ago
OCSP stapling may be what you're looking for. The certificate stays the same, but an additional short-lived signature indicating that it wasn't revoked yet is attached.
Aside from not spamming the CT log and possibly making it easier to offload the generation of the OCSP responses to a more efficient architecture than the one needed to issue certificates, I'm not sure how mandatory OCSP stapling is better than just reissuing the certificate every day/week.