Continuing the discussion from Pros and cons of 90-day certificate lifetimes : so in my opinion posting a poll in the somewhere in a 200+ posts discussion is plain messy I am starting this Poll Thread. before you wildly click let’s remeber this: creating a way to get longer cert times is not again…

well must staple is also optional for pretty much similar reasons: clients must understand it. if OCSP is down while the server wants to fetch it, well forget it the server doesnt support OCSP stapling which might especially the case when you are either talking about non-http servers or services…

[image] My1: if OCSP is down while the server wants to fetch it, well forget it That means it's completely useless. Revocation is used when your key is compromised. In order to make use of a stolen key, an attacker must be able to MitM the target. If the attacker is able to MitM the target, h…

well must staple is also optional for pretty much similar reasons: clients must understand it. That doesn't mean it needs to be optional, since clients that do not understand it will ignore it. (Same as your “must check” flag). if OCSP is down while the server wants to fetch it, well forget i…

by the way I dunno whether you know it or not, but OCSP hardfail is already implemented in some certs, the EVs (you dont wanna know how often the WoSign website failed for me. okay LE doesnt do EV but it’s plain about the hardfail concept which already does exist. also obviously I think that hard …

also a hardfail flag wouldnt increase the load on the OCSP much because all clients that do OCSP are already doing it. a hardfail doesnt suddenly increase the number of OCSP checks. Wrong. Chrome and Chromium do not perform OCSP checking by default. Please, read up on the things you were linked…

I thought they always check but are soft fail. I mean where’s the point in setting up OCSP if no browser checks it.

[image] My1: I thought they always check but are soft fail. cf Revoked certs not showing as revoked in browsers

okay this is so goddamn stupid. why completely ignore the OCSP system? why revoke at all if nobody checks it?

It is explain at https://www.imperialviolet.org/2014/04/19/revchecking.html that @nicoo linked. In short, because it does not work as a revocation system, slow down connection, leak the list of sites you consult to CAs.

Thanks a lot for the concise explanation. As I said, though, I believe that short-lived certs are a viable alternative to revocation.

[Poll] Do we need longer cert validity times?

Issuance Policy

Nit March 27, 2016, 9:54pm 38

cf Revoked certs not showing as revoked in browsers

Topic		Replies	Views
Pros and cons of 90-day certificate lifetimes Issuance Policy	443	99612	February 6, 2017
Should LE allow for shorter and longer cert life times? Issuance Policy	30	4478	December 22, 2018
Maximum (and minimum) certificate lifetimes? Issuance Policy	242	85724	November 30, 2015
6 day certificates!? Pinch me I'm dreaming Issuance Policy	36	2500	December 31, 2024
About day certificates Issuance Tech	14	490	February 27, 2025

[Poll] Do we need longer cert validity times?

Related topics