4 ms·
If you cache the revocation list, you lose all the benefits of instant revocation making the whole process pointless.
by redleader55 1y ago
If you cache the revocation list, you lose all the benefits of instant revocation making the whole process pointless.
- sugarpimpdorsey 1y agoOCSP is dead. We don't have that luxury anymore. By caching I meant for 12-24 hrs.
- redleader55 1y agoAgain, if you need to revoke a certificate, it means something terrible happened - someone compromised your server and your website has a good chance to be impersonated by 3rd parties. In all the other cases, you just let the old cert expire. You likely don't want people finding out about the revocation 12-24 hours later.
- robertlagrant 1y agoOCSP-stapling seemed to be fine with 24-48 hour client-side caching, though.