3 ms·
According to the link you posted, there are intermediate CAs. Those could be revoked and effectively revoke all the end entity certificates.
by shallichange 4y ago
According to the link you posted, there are intermediate CAs. Those could be revoked and effectively revoke all the end entity certificates.
- tialaramex 4y agoWhen they write "essentially on-line root certificates" they don't mean that they're literally on-line root certificates, because that's prohibited. They're essentially on-line root certificates because they serve most of the function that such roots would serve if they were allowed. There aren't a bunch more available to replace them, so this means recovery now requires a key ceremony, figure on a week to a month to arrange that. Whereas if you're able to "just" revoke 10 million end entity certificates you can recover immediately.