Hacker News Reader

If the intermediate is compromised you'll need to do a new key ceremony with the root to sign a new CRL, correct? And I'm assuming every component is configured to explicitly check CRLs and fail if those are unavailable for whatever reason, right? How does it ensure that the CRL it's getting is the latest CRL including the now-revoked certificate, and not an earlier one that's being replayed?

View on HN

PKI revocation as a technology is definitely not the greatest thing in the world, the best protocol at the moment is OCSP with a specifically configured Validation Authority. But even then quite a lot of OCSP implementations in modern software are configured to continue if they can't make a connection.

Fortunately, because the usage of our CAs is very tight to Monzo and our partners, we can reach out and explicitly ban a certificate from our machines (and tell partners to do the same) without too much trouble (as compared to Public CA's who have no chance of being able to do this) in addition to following normal PKI revoking procedures.

> If the intermediate is compromised you'll need to do a new key ceremony with the root to sign a new CRL, correct?

You can use Validation Authorities to avoid needing the full on root that can issue new certs just to revoke an existing one. https://en.wikipedia.org/wiki/Validation_authority

Reply on news.ycombinator.com