3 ms·
AFAIK those are standards for allowing CAs to revoke certificates. Trust conditions for root stores are a completely different thing. Or at least, I'm certainl
by Ajedi32 4y ago
AFAIK those are standards for allowing CAs to revoke certificates. Trust conditions for root stores are a completely different thing.
Or at least, I'm certainly not aware of any mechanism in the CRL standard to "partially revoke" a CA certificate based on complex conditions like "What's the notBefore date on the leaf certificate we're currently validating?".
- ak217 4y agoAh I see, you're right I guess they didn't contemplate the scenario of "we want to distrust this CA - against its wishes - but we still trust it enough to make it an orderly transition instead of an emergency". I guess it was previously assumed that CA trust would be binary and that CAs would be cooperative - seems like a pretty common evolution that internet standards go through. The problem is, code that handles these things is safety critical and requires real and sustained investment to be reliable. Given this overhead (and the gaps in CRL/OCSP support that I mentioned), it's unclear if this use case will be common enough to commit to supporting.