3 ms·
> If they didn't fail open, every time a CA's website went down every single website that used their certificates would go offline as well. That's not correct.
by vbezhenar 5y ago
> If they didn't fail open, every time a CA's website went down every single website that used their certificates would go offline as well.
That's not correct. OCSP stamps exist to prevent that kind of a problem.
- zauguin 5y agoOCSP always seemed a bit absurd to me: Instead of sending a OCSP stamp, the CA could also issue a very short lived certificate on demand. It would have the same effect of asserting that the CA currently considers the server to be verified and it doesn't need a separate format.