To really protect against active attacks, browsers can't just re-enable OCSP checking (i.e. return to the status quo as of a few years ago). They would also ne

To really protect against active attacks, browsers can't just re-enable OCSP checking (i.e. return to the status quo as of a few years ago). They would also need to make failure to contact the OCSP server a fatal error (something which I don't think has ever been done by default before), and that would probably cause so many problems I can't imagine the browsers doing that. Personally, I'm never again going to buy a cert that's valid for more than 1 year, and even that's too long. Google uses certs that are valid for only a few months, but they're only able to do that because they are their own certificate authority.