A New Life for Certificate Revocation Lists

Post by ok_dad » Wed, Sep 07, 2022, 7:54 PM UTC

agwa wrote: post #11

ok_dad wrote: post #10

Earlier quoted context omitted.

> Beginning October 1, you will be able to just download the CRLs Correction: Apple and Mozilla will be able to just download the CRLs. Not me. The link in the post SPECIFICALLY says us common plebes don't get that right.

Where does the post say that? If you think it's because the URLs will be disclosed in the CCADB, note that the contents of the CCADB are published here: https://www.ccadb.org/resources Specifically, the CRL URLs can be found in this CSV file: http://ccadb-public.secure.force.com/ccadb/AllCertificateRec...

Post by luhn » Wed, Sep 07, 2022, 7:55 PM UTC

Post by chrisfosterelli » Wed, Sep 07, 2022, 8:03 PM UTC

ok_dad wrote: post #12

agwa wrote: post #11

Earlier quoted context omitted.

Where does the post say that? If you think it's because the URLs will be disclosed in the CCADB, note that the contents of the CCADB are published here: https://www.ccadb.org/resources Specifically, the CRL URLs can be found in this CSV file: http://ccadb-public.secure.force.com/ccadb/AllCertificateRec...

I was pretty sure this section meant what I said but maybe you can get them from that database without being a BigCo?: “Our new CRL URLs will be disclosed only in CCADB, so that the Apple and Mozilla root programs can consume them without exposing them to potentially large download traffic from the rest of the internet at large.”

Post by agwa » Wed, Sep 07, 2022, 8:07 PM UTC

chrisfosterelli wrote: post #16

ok_dad wrote: post #12

Earlier quoted context omitted.

I was pretty sure this section meant what I said but maybe you can get them from that database without being a BigCo?: “Our new CRL URLs will be disclosed only in CCADB, so that the Apple and Mozilla root programs can consume them without exposing them to potentially large download traffic from the rest of the internet at large.”

I assumed what they meant is that the database is publicly available but that browser implementations won't be directly pulling CRLs. Instead the browser providers pull the CRLs and create a compressed version that their browser users download. In the same way that you can technically query the DNS root servers yourself but you don't tend to do that because your computer will query a more downstream DNS server.

Post by shallichange » Wed, Sep 07, 2022, 8:43 PM UTC

mholt wrote: post #15

luhn wrote: post #14

> If we had an incident where we needed to revoke every single one of those certificates at the same time, the resulting CRL would be over 8 gigabytes. I don't know much about this stuff, so apologies if this is a silly question: If you needed to revoke all the certificates, couldn't you just revoke the handful of intermediary certificates and call it a day? I assume you'd want to revoke them anyways if there's a sit…

It's a good question, if I read you rightly. There is no "handful" of intermediate certificates -- there are precisely 4 (for Let's Encrypt [0]) and they are essentially on-line root certificates. And if those certificates aren't even compromised, revoking them would only harm the ecosystem. [0]: https://letsencrypt.org/certificates/