4 ms·
CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's a
by m-p-3 1y ago
CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's an outage and the request can't be made instead of a hard fail and making the website inaccessible, reducing the security and usefulness of OCSP.
Short-lived certificates fixes these issues from an end-user standpoint.
- ozim 1y agoThere are new solutions for CRL just last month: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-comprehensive-certificate-revocation-checking-in-firefox/ https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...
- aaomidi 1y agoThis has existed for a while. It doesn’t address another major issue with revocation: user agents that aren’t browsers don’t implement it.
- crazygringo 1y agoYup. If your primary goal was fast, efficient certificate revocation, then having certs that still take 90 days to expire rather than 2 years is not the solution you'd come up with. CRLite updates every 12 hours.
- ozim 1y agoIf you have short validity times for certificates it also means you have shorter CRL.
- crote 1y agoNot by definition. The main issue is mass revocation events: the CRL is still going to initially contain up to 100% of certs currently active, and the number of active certs won't meaningfully change. It'll rapidly shrink over time as certs expire, but you still have to deal with that initial massive set.
- TedDoesntTalk 1y agoIs it possible that one day certificate expiration will be a thing of the past?
- LtWorf 1y agoHow would they get recurring revenue/donations then?