4 ms·
That's issue with buggy clients which should not proceed if CRL is not available. Not issue with PKI per se.
by vbezhenar 5y ago
That's issue with buggy clients which should not proceed if CRL is not available. Not issue with PKI per se.
- octoberfranklin 5y agoIf they didn't fail open, every time a CA's website went down every single website that used their certificates would go offline as well. You can imagine the DDOS-ransomers licking their lips at this possibility. No, "fail open" has always been the only possible way to implement this. Which is why it's a broken idea from the start.
- vbezhenar 5y ago> If they didn't fail open, every time a CA's website went down every single website that used their certificates would go offline as well. That's not correct. OCSP stamps exist to prevent that kind of a problem.
- zauguin 5y agoOCSP always seemed a bit absurd to me: Instead of sending a OCSP stamp, the CA could also issue a very short lived certificate on demand. It would have the same effect of asserting that the CA currently considers the server to be verified and it doesn't need a separate format.