3 ms·
This does seem like a situation where a CRL would be a better fit than OCSP. On the other hand, CRLs have been pretty thoroughly deprecated for browser usage, s
by wiml 6y ago
This does seem like a situation where a CRL would be a better fit than OCSP. On the other hand, CRLs have been pretty thoroughly deprecated for browser usage, so Apple probably just reached for the first tool that was already available to them.
- viraptor 6y agoIs actually the other way. Active ocsp checks have been removed some time ago: https://www.computerworld.com/article/2501274/google-chrome-will-no-longer-check-for-revoked-ssl-certificates-online.html https://www.computerworld.com/article/2501274/google-chrome-... Stapling and crl-shipped-with-browser still works.