3 ms·

I don't get the OCSP Stampling protocol: if the server needs / is able to to contact the CA frequently anyway, why not simply use very short-lived certificates?

• eqvinox 2y ago
  Issuing a certificate has significantly more overhead (e.g. Certificate Transparency logs) than signing a statement that an existing certificate is still valid.
• briansmith 2y ago
  Which CA's will issue short-lived certificates without negotiating a custom ($$$) contract with them?
  • agwa 2y ago
    Google Trust Services lets you go down to 1 day using ACME. No payment required.
  • kmeisthax 2y ago
    Let's Encrypt, they said a while back they want to allow issuing certs for fewer than 90 days.
    • schoen 2y ago
      That's true, although it's still not possible to actually get one yet.