I don't really understand why the approach towards checking the validity of certificates is "valid until proven otherwise" (aka revocation lists).
In my opinion this is kind of weird. A CA has to manually keep track of all the certificates it issued and explicitly revoke the ones that shouldn't be authenticated any more.
Wouldn't it make more sense to force CAs to keep databases with the certificates they issued or even better: have each certificate signed with a seperate key that is stored in the CAs database and if you want to revoke the certificate you just have to delete its entry?
Because if you look at use cases like client certificates on Apache for instance you always have to keep track of the certificates you issued (e.g. for each employee in a company). Once an employee leaves the company you have to revoke his/her certificate. But without ssl/tls by default forcing you to to have an "active certificates list", doesn't this create margin for errors (aka forgetting to revoke a client certificate)? I mean there are other means to keep track of that (databases, LDAP etc.) but shouldn't the "not valid until explicitly validated"-approach not at least be an option? Or is there a solution for that (except from third party software)?
And furthermore: Why is the CRL-URI in a DigiCert certificate http and not https, doesn't this mean I can just spoof this address and return a "everything is fine and dandy"-CRL to the client?
I mean the DigiCert CRL has a signature under it which proves to the client that this is a valid CRL issued by the CA but is this mandatory? E.g. do browsers demand a signature under each crl they receive and what do they do if they don't get any crl at all?