3 ms·
Won't this create the ability for a 3rd party to disable your site by having the CA revoked against your will? For example, in regards to a copyright issue? Pe
by RexRollman 13y ago
Won't this create the ability for a 3rd party to disable your site by having the CA revoked against your will? For example, in regards to a copyright issue?
Personally, I am against this, as I feel that this is a choice that should be made on a site by site basis.
- dubcanada 13y agoI'm 90% sure you can't disable someones SSL certificate once they have it. Which is why most of the time it takes a bit to actually get it.
- grahamedgecombe 13y agoOCSP and CRLs allow a CA to revoke an SSL certificate (albeit with a varying degree of browser support).
- mnordhoff 13y agoYes. They can already do this more reliably by disabling your domain name, though (not to mention your hosting). Edit (T+16 minutes): I said "more reliably" because not all TLS clients perform CRL or OCSP checks -- as mentioned in other comments -- so it's not 100% effective. Web browsers probably mostly all do, though. Certainly enough of them do that running a website with a revoked cert is impractical. As for disabling your domain name, if you don't know, that really does happen. US law enforcement seizes domains on US TLDs (such as .com) all the time. Edit (T+23 minutes): ... and registrars have been known to cave to strongly-worded letters from civilians, too (see e.g. Go Daddy, MySpace and seclists.org several years ago).