Hacker News new | past | comments | ask | show | jobs | submit login

I'm aware. That trust model is inherently broken, and it's not followed anyway. In practice, any CA you trust can sign a revocation for any certificate (the serial numbers are all grouped together) - And that's the way it should be. You should not wait for the issuing CA to get it's act together, you should burn a certificate as soon as anyone distrusts it, and if you have a rogue CA that starts burning Google.com and other important sites, it's better that they burn them (and take you offline) than that they issue false certs (and leak all your data); It's also far more obvious.

https://www.imperialviolet.org/2014/04/19/revchecking.html

Revocation checking is useful for your security team to blacklist site. That's the only useful use.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: