9 ms·

Thanks. Which values are you using for the matching? I was assuming a fingerprint of the cert. Have you considered compressing the domains? Compiling them to a

by gorset 15y ago

Thanks. Which values are you using for the matching? I was assuming a fingerprint of the cert. Have you considered compressing the domains? Compiling them to a DFA should yield a very small structure, and you then will need far fewer bits for the actual fingerprint.

agl 15y ago
We can only use the information that the CAs give us, which is the serial number of the certificate. So we match the serial number and issuer.
MichaelGG 15y ago
If you use the domains, then any domain that ever had a cert revoked would hit, and need a secondary lookup. That means some of the busiest sites on the Internet would not benefit from this check. Also, I think if you re-issue or otherwise change your cert, the old one goes into the CRL, even if it wasn't for a compromise, right? (Which would explain a high number of revocations?)