Re:Intent to End OCSP Service
by remram on Tuesday July 23, 2024 @08:03PM
(#41052345)
So my client should download the 100 MB CRL to check? Is that the secure workflow?
[ Parent
| on HN ]
Re:Intent to End OCSP Service
by warhorse10_9 on Tuesday July 23, 2024 @08:44PM
(#41052566)
Modern crls are partitioned so this really isn’t a problem you will run into.
Does that not recreate the privacy problem then, since the CRL server can see which CRL partition we download and when?
Should we expect CRL stapling?
I think one would expect a partition to cover a lot of certificates for its size (or in the case of a compromise all certificates mapped to that partition) so I don't think you end up with nearly so meaningful a problem.
Re:Intent to End OCSP Service
by mcpherrinm on Tuesday July 23, 2024 @09:22PM
(#41052771)
The largest Let's Encrypt CRL right now is 254 KB. Most are smaller. We might want to partition into smaller shards again to hit a bit smaller size than that in the future.
Shorter certificate lifetimes will also reduce CRL sizes.
A lot of traffic comes from browsers, or TLS stacks integrated with their host operating system, which we expect will use compressed push-based methods like Mozilla's CRLite to receive more efficient data structures as well.
One thing this announcement allows us to do is motivate us to start working on making CRL mechanisms more efficient.