Subject: [pkix] A well-researched article on use of CRLs in browsers

From: Paul Hoffman <[email-masked]>
Date: Mon, 13 May 2013 10:08:26 -0700

http://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-doesnt-work-in-practice.html

The Netcraft folks are well-known for their research and non-flamingness.

--Paul Hoffman

---

From: "Piyush J.comain" <[email-masked]>
Date: Mon, 13 May 2013 10:21:23 -0700

It got to me with the opening hook - "Certificate revocation is intended to
convey a complete withdrawal of trust in an SSL certificate and thereby
protect the people using a site against fraud, eavesdropping, and theft"

Promoting the common misconception that PK certificates are only good for
establishing trust in SSL sites.

Also, I find the conclusion that revocation is shaky because browser
implementations are not consistent, a little shaky itself :).

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul
Hoffman
Sent: Monday, May 13, 2013 10:08 AM
To: [email-masked] PKIX
Subject: [pkix] A well-researched article on use of CRLs in browsers

http://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-does
nt-work-in-practice.html

--Paul Hoffman
_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: "Jeremy Rowley" <[email-masked]>
Date: Mon, 13 May 2013 11:50:06 -0600

>From a practical standpoint, all of the browsers expect notification of
revocation of an intermediate certificate.   Mozilla, in the past, has
blacklisted revoked intermediates directly in the browser instead of relying
on revocation information.   Granted, revoked intermediates in the past have
been associated with industry events, but I suspect they blacklist most
revoked intermediates since intermediate revocation occurs so infrequently.

Although the intermediate mentioned in the article lacked an OCSP URL, the
CAB Forum's baseline requirements specify that all new intermediates must
have OCSP. This requirement should lead to more uniform revocation checking
practices (over time), decreasing the likelihood of a browser missing the
revoked certificate.  In addition, implementation of Yngve's recently
adopted multi-stapling RFC will decrease any performance costs caused by an
intermediate revocation check and likely increase the availability of this
information.

Jeremy

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul
Hoffman
Sent: Monday, May 13, 2013 11:08 AM
To: [email-masked] PKIX
Subject: [pkix] A well-researched article on use of CRLs in browsers

--Paul Hoffman