4 ms·
That's the same way a CA works (except with a bit of automation instead of emailing someone). I go to the CA that issued my cert and say "I'd like to revoke th
by X-Istence 6y ago
That's the same way a CA works (except with a bit of automation instead of emailing someone).
I go to the CA that issued my cert and say "I'd like to revoke this" (whether that is an API call or an email), they then publish the cert into their certificate revocation list.
Now, Apple could deny a request, but they are under no obligation to do so, and I would argue that they shouldn't be making those judgement calls.
As they did here, they get the email, they then publish the CRL, and wash their hands off it.
- saagarjha 6y agoBut that is exactly what they claim they are there to do. They should either just accept any request, or do a good job at denying incorrect revocations.
- X-Istence 6y agoWhere do they claim to do that? Maybe there is no API for it because it happens so rarely that letting the Apple Security team push a few buttons is more cost effective.