News for hackers. Stuff that matters.
Re:How I got a valid SSL certificate for my ISP's main domain by AnthonyMouse on Saturday March 21, 2015 @04:41PM (#9244139)
Someone please tell me why doing it that way is better than the following:

You validate yourself in the usual way and present a CSR to the CA. The CA signs the certificate but only with a very short expiration. However, unless the certificate is "revoked", you can come back at any point and the CA will automatically sign an identical certificate with the sole exception of the expiration date. (Then maybe they stop after e.g. two years unless you validate again, to keep an "actual" expiration.)

The advantage of that over OCSP stapling is that it requires zero modification to the client. What advantage does OCSP stapling have over that?

There are no comments on this comment yet.