3 ms·
As the set of certificates is bounded and known by apple, they can also adopt crlite and just push all CRLs they have to all users, using CRLite. https://githu
by est31 6y ago
As the set of certificates is bounded and known by apple, they can also adopt crlite and just push all CRLs they have to all users, using CRLite.
https://github.com/mozilla/crlite https://github.com/mozilla/crlite
- remram 6y agoI assumed there were too many revoked certificates for something like this to be viable, but I'm not surprised it is. You probably can't update the whole list that often though, compared to Apple's current OCSP revalidate time of 5 min. [edit: seems "delta patches" are supported by crlite so maybe that can work too]
- est31 6y ago> I assumed there were too many revoked certificates for something like this to be viable, but I'm not surprised it is. Given that Apple currently doesn't even encrypt the requests during transit, I think they just didn't pay much attention to the problem, which I think the main reason is why they haven't adopted it yet. As for the number of revoked certificates, I'm not sure it's larger than the number of revoked TLS certificates, given that there are way more websites out there than there are registered apple developers.