3 ms·
And Let's Encrypt actually provides an API for this: https://letsencrypt.org/docs/revoking/#using-a-different-authorized-account https://letsencrypt.org/docs/re
by tgsovlerkhgsel 2y ago
And Let's Encrypt actually provides an API for this: https://letsencrypt.org/docs/revoking/#using-a-different-authorized-account https://letsencrypt.org/docs/revoking/#using-a-different-aut...
I don't think it makes a significant difference (I believe browsers don't implement revocation in any meaningful way), but the option exists.
- aaomidi 2y agoFirefox does do revocation.
- tgsovlerkhgsel 2y agoHuh, you're right - it also seems to be enabled by default. I tried with a clean profile and https://revoked.badssl.com/ https://revoked.badssl.com/ showed an error (Chrome loads the page).
- crcastle 2y agoiOS Safari also shows an error and refuses to load the page.
- vetrom 2y agoLots of browsers avoid it for reasons, but isn't this the whole point of the OCSP(https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Pr...) and OCSP stapling?
- tgsovlerkhgsel 2y agoYes, protocols for this exist... but as you said, browsers tend to avoid them. Edit: Firefox seems to check revocation by default. https://revoked.badssl.com/ https://revoked.badssl.com/ if you want to test.
- neurostimulant 2y agoThis requires the certificat's private key, right? Can you download the key for letsencrypt certificates generated by cloudflare?
- agwa 2y agoNo, if you can complete challenges for every DNS name in the certificate then the API lets you revoke it.
- tgsovlerkhgsel 2y agoNo, as the section I linked explains, you can also prove that you own the domain and then revoke the cert without having the private key. It's meant exactly for cases where some other party has obtained a cert for your domain for whatever reason (change of ownership, compromise, ...)