News for hackers. Stuff that matters.

A comment on Ways to reduce the costs of an HTTP(S) API on AWS.

Re:Ways to reduce the costs of an HTTP(S) API on AWS by tumetab1 on Friday December 13, 2019 @11:18AM (#21782880)
> Also, the certificate contains lengthy URLs for CRL download locations and OCSP responders, 164 bytes in total.

If you're going on that path It's probably best to avoid revocation altogether, since it doesn't really work, and go the let's encrypt way, certificates with lower lifespans.

On that scale a 15 days cert on rotation is probably fine.

[ Parent | on HN ]
Re:Ways to reduce the costs of an HTTP(S) API on AWS by mhenoch on Friday December 13, 2019 @11:32AM (#21783008)
That's a good point. Seems like Let's Encrypt certificates contain an OCSP URL but no CRL URL, so they are a bit smaller.
[ Parent | on HN ]