Re:Heartbleed certificate revocation tsunami yet to arrive
by mballantyne on Saturday April 12, 2014 @02:23AM
(#7577156)
AFAICT, here isn't really any benefit for most people. If you're using an Extended Validation certificate the revocation would remove the EV presentation in most browsers.
The only way you'd get a browser to totally fail to load the page in the case of a MITM that can block the OCSP servers is Chrome's CRLSets. Only a limited set of revocations are included due to space constraints though; mostly EV certs from select CAs and Intermediate CA certs.
A good solution to this problem would be short lived certificates, but that idea has yet to find much traction.
The only way you'd get a browser to totally fail to load the page in the case of a MITM that can block the OCSP servers is Chrome's CRLSets. Only a limited set of revocations are included due to space constraints though; mostly EV certs from select CAs and Intermediate CA certs.
A good solution to this problem would be short lived certificates, but that idea has yet to find much traction.
http://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-shortliv... http://dev.chromium.org/Home/chromium-security/crlsets http://blog.spiderlabs.com/2011/04/certificate-revocation-be...