3 ms·
That's a fair point [PKI without TLS], but I'd argue that 99.9% of situations will be with TLS. Thus supporting revocation can provide value for those. Out of
by ivanr 3y ago
That's a fair point [PKI without TLS], but I'd argue that 99.9% of situations will be with TLS. Thus supporting revocation can provide value for those.
Out of curiosity, what without-TLS use cases do you have in mind?
- ak217 3y agoMost SSO runs on SAML, which uses XML Signature, which uses PKI certificate chains without TLS. Even if you think all SSO will migrate to OIDC, the EU has enacted laws around electronic signatures that basically enshrine the use of XML Signature (with all its problems) for the foreseeable future. A lot of countries beyond the EU (many LatAm countries, for example) have followed suit. There are other signature protocols that use certificate chains as well, and devices and networks that should not be making network calls when validating such signatures. And as I mentioned, TLS uses are not limited to those where revocation information is readily accessible.