3 ms·
It's a good question, if I read you rightly. There is no "handful" of intermediate certificates -- there are precisely 4 (for Let's Encrypt [0]) and they are e
by mholt 4y ago
It's a good question, if I read you rightly.
There is no "handful" of intermediate certificates -- there are precisely 4 (for Let's Encrypt [0]) and they are essentially on-line root certificates. And if those certificates aren't even compromised, revoking them would only harm the ecosystem.
[0]: https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/
- shallichange 4y agoAccording to the link you posted, there are intermediate CAs. Those could be revoked and effectively revoke all the end entity certificates.
- tialaramex 4y agoWhen they write "essentially on-line root certificates" they don't mean that they're literally on-line root certificates, because that's prohibited. They're essentially on-line root certificates because they serve most of the function that such roots would serve if they were allowed. There aren't a bunch more available to replace them, so this means recovery now requires a key ceremony, figure on a week to a month to arrange that. Whereas if you're able to "just" revoke 10 million end entity certificates you can recover immediately.