https://groups.google.com/forum/#!searchin/mozilla.dev.security.policy/OCSP/mozilla.dev.security.policy/mwmg2X74vlI/fYEljQnJVN4J https://groups.google.com/forum

https://groups.google.com/forum/#!searchin/mozilla.dev.security.policy/OCSP/mozilla.dev.security.policy/mwmg2X74vlI/fYEljQnJVN4J https://groups.google.com/forum/#!searchin/mozilla.dev.secur... for example (3 years old). The right keyword to search for is OCSP, because CRLs are completely impractical in the browser. But then we have the issue that OCSP is a pretty retarded protocol. OCSP stapling helps with some issues, but there is still the issue that it doesn't really check if a certificate is valid, but whether a certificate bearing the given serial number is valid. Which didn't help AT ALL when using MD5 collisions people managed to create multiple certificates under the same serial number.