New answers tagged

1

That could be that an IT person said "I don't want to deal with this", and did the CA equivalent of "Postpone reboot for 100 years". Or it could be a CRL intended for an offline environment where the clients validating certs will not have access to the internet to fetch a new CRL. For example, IoT devices inside a car that are communicating with each other ...


3

Not very well. In theory, the system should work. In practice, it doesn't. The implementations intended to manage revocation - namely CRL and OCSP - both have problems. Most of this answer is based on this article by Alexey Samoshkin, as well as this article by Scott Helme. What about CRLs? A certificate revocation list is a remarkably simple way of ...


Top 50 recent answers are included