4 ms·

We did this by mistake once and got bug reports about PayPal being flakey. (PayPal was an early HSTS adopter.)

• fastest963 13y ago
  Understandable, admins would just have to start treating OCSP like they do DNS (if it fails you can't visit site).
  • derefr 13y ago
    A thought: given that admins already have something that they treat like DNS--which is to say, DNS--could certificate revocations be distributed as DNS TXT records, and thus reuse all the caching infrastructure DNS currently implies?
    • is39 13y ago
      I think this would be a good approach on many levels. It appears there is already an (expired?) internet draft for this: https://datatracker.ietf.org/doc/draft-pala-rea-ocsp-over-dns/ https://datatracker.ietf.org/doc/draft-pala-rea-ocsp-over-dn... http://tools.ietf.org/html/draft-pala-rea-ocsp-over-dns-00 http://tools.ietf.org/html/draft-pala-rea-ocsp-over-dns-00 But i could not find any browser support or even plugins. I guess all current development is behind DANE and/or multi-OCSP-stapling; second one has some chance of being deployed soon. https://bugzilla.mozilla.org/show_bug.cgi?id=611836 https://bugzilla.mozilla.org/show_bug.cgi?id=611836 https://datatracker.ietf.org/doc/rfc6961/ https://datatracker.ietf.org/doc/rfc6961/ --igor