I have two questions regarding the safety of requesting CRLs.
My first question is: shouldn't CRLs contain a
producedAtfield just like OCSP responses? This would make sure a hacker doesn't send an old (but not yet expired) CRL to the client, right? Why isn't this done? Is it because CRLs are bigger and signing them each time would cost too much time? Or is it because CRLs are seen as static files (which wouldn't be a really good reason)?
Then my second question. I've seen my browser requested a CRL with an HTTP
If-Modified-Sinceheader. The server responded with a
304 - Not Modifiedcode. Wouldn't this also be an easy way for hackers to withhold updates to a CRL (as long as the old one's still valid)?