2 ms·
How is this actually better (or conceptually even different) than just having the issuer's servers issue new certificates that only last 24 hours?
by saurik 1y ago
How is this actually better (or conceptually even different) than just having the issuer's servers issue new certificates that only last 24 hours?
- Ayesh 1y agoIt's not better. Short lived certificates are definitely the better way forward. 24 hour certificates will add a significantly more load on CAs, a lot more than maintaining an OCSP responder.
- saurik 1y agoBut, signing the updated expiration date seems like exactly the same amount of signing as just signing the entire certificate?