Hi,
I've got a question about shortlived certificates, most specifically about the Revocation Information.
The documentation (Profiles - Let's Encrypt) mentions that "This allows these certificates to qualify as “Short-Lived Subscriber Certificates” under the Baseline Requirements, which means they do not need to contain any revocation information. This means the certificates can be even smaller, and removes any possibility of a client accidentally trusting a certificate after it has been revoked." (emphasis mine) but then on the table "Revocation Information: CRL" is used.
The table at the bottom (Revocation Information) also mentions: "Generally there are three mechanisms for this in the Web PKI: the Online Certificate Status Protocol (OCSP), Certificate Revocation Lists (CRLs), and having a validity period so short that revocation is unnecessary."
I've checked and it seems my shortlived certificate contains the CRL distribution points extension (with the value of URI: http://ye1.c.lencr.org/103.crl).
Is it planned to remove CRLs from shortlived certs or is the documentation not up to date?
Thanks for help clarifying this issue!
Kind regards,
Wiktor
. Thanks!