4 ms·

> only issue certificates for a short period of time, like 10 days (but renewed every 7) That's essentially the situation we're in with OCSP stapling, if you c

• AnthonyMouse 12y ago
  Someone please tell me why doing it that way is better than the following: You validate yourself in the usual way and present a CSR to the CA. The CA signs the certificate but only with a very short expiration. However, unless the certificate is "revoked", you can come back at any point and the CA will automatically sign an identical certificate with the sole exception of the expiration date. (Then maybe they stop after e.g. two years unless you validate again, to keep an "actual" expiration.) The advantage of that over OCSP stapling is that it requires zero modification to the client. What advantage does OCSP stapling have over that?