4 ms·

It's because CRLs/OCSP sucks so now short expiration is rolling out.

• ozim 1y ago
  CRL doesn’t suck it is just not easy problem on web scale. But seems like there is feasible solution: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...
  • aaomidi 1y ago
    AKA they suck in this context
    • ozim 1y ago
      Was CRL designed with this context in mind?
      • aaomidi 1y ago
        Doesn’t matter. I think we’re fighting semantics. Certificates are cached trust, and all the cache busting problem applies here.