21–30 of 72 posts
Is certificate revocation really so common a crl of a normal authority is gigabyte sized?
So, no, it's not common. But it's necessary.
Earlier quoted context omitted.
I was pretty sure this section meant what I said but maybe you can get them from that database without being a BigCo?: “Our new CRL URLs will be disclosed only in CCADB, so that the Apple and Mozilla root programs can consume them without exposing them to potentially large download traffic from the rest of the internet at large.”
I have a cron job that pulls that CSV file once a day. I assure you I am not a BigCo.
Is certificate revocation really so common a crl of a normal authority is gigabyte sized?
[1] https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/pdf/uncl... - Pg 7, under Local Cache
I was kind of surprised that OCSP stapling didn't get any mention at all. I thought that was a major improvement in both resource cost and privacy? Since the time stamped response is proxied by the site operator rather then going directly to the CA, the load is almost entirely switched to the site itself, and the site itself is the only one who knows a given IP is asking for it, which is fine because obviously the si…
Yes, I noticed this too and asked the author about it [0]. IMO, OCSP stapling is the best overall solution until certificate lifetimes are shorter ( As a server developer I'm worried that the focus on independent CRLs will make it difficult to automate certificates in the face of revocation. Currently, Caddy staples OCSP for all certificates by default, caches the staples, and refreshes them halfway through their lif…
Couldn't they just use actual units? This says absolutely nothing.
> This means that they’re often very large – easily the size of a whole movie. Couldn't they just use actual units? This says absolutely nothing.
When I was reading the thread the other day about a trees worth of oxygen from the MOXIE experiment, I couldn't help thinking: why not just use a term everyone is familiar with, litres per minute air.
Enough oxygen to sustain an adult at rest for x minutes.
I'm beginning to suspect there's an in-joke with science / tech writers about strained analogies.
And I'm not in.
I was kind of surprised that OCSP stapling didn't get any mention at all. I thought that was a major improvement in both resource cost and privacy? Since the time stamped response is proxied by the site operator rather then going directly to the CA, the load is almost entirely switched to the site itself, and the site itself is the only one who knows a given IP is asking for it, which is fine because obviously the si…
> If we had an incident where we needed to revoke every single one of those certificates at the same time, the resulting CRL would be over 8 gigabytes. I don't know much about this stuff, so apologies if this is a silly question: If you needed to revoke all the certificates, couldn't you just revoke the handful of intermediary certificates and call it a day? I assume you'd want to revoke them anyways if there's a sit…
We have a set of backup intermediates that can be activated if we had to revoke the active ones for any reason, so the disruption wouldn’t be too high hopefully.
(I work at Let’s Encrypt, but this is my own opinion and not that of my employer)
Is certificate revocation really so common a crl of a normal authority is gigabyte sized?
Looking at a random CRL [2] it's 41 bytes per revoked certificate.
8 million records at 41 bytes per record would be 300+ Megabytes. And a cautious CA might keep revoked certificates in their CRL for more than a year.
So if an event like heartbleed happened again and uncommonly large numbers of certificates needed to be revoked, the gigabyte range is within the bounds of possibility.
[1] https://news.netcraft.com/archives/2014/04/11/heartbleed-cer... [2] http://crl3.digicert.com/Omniroot2025.crl [3] https://www.grc.com/revocation/crlsets.htm