Yeah, probably. But CRLs were always unreliable (how much software do you think blocks the connection if the CRL/OCSP/... cannot be found? You need to twiddle a

Yeah, probably. But CRLs were always unreliable (how much software do you think blocks the connection if the CRL/OCSP/... cannot be found? You need to twiddle a well-hidden switch in Firefox to make it check, and the results are not pretty - big CAs like Verisign time out all the time). Something like https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-... is far more likely to actually bite you.