Hacker News Reader

Comment by mkonecny | Hacker News Reader

Out of curiousity, it there really any benefit to revoking a certifcate? Most (all?) of the leading browsers do not check the revocation list, so this move seems like an empty gesture. Is the Internet vulnerable to MITM attacks until this generation of certificates expire?

Do you think Firefox, Chrome will release an update in the next few weeks with revoked certificate checks enabled?

View on HN

To really protect against active attacks, browsers can't just re-enable OCSP checking (i.e. return to the status quo as of a few years ago). They would also need to make failure to contact the OCSP server a fatal error (something which I don't think has ever been done by default before), and that would probably cause so many problems I can't imagine the browsers doing that.

Personally, I'm never again going to buy a cert that's valid for more than 1 year, and even that's too long. Google uses certs that are valid for only a few months, but they're only able to do that because they are their own certificate authority.

AFAICT, here isn't really any benefit for most people. If you're using an Extended Validation certificate the revocation would remove the EV presentation in most browsers.

The only way you'd get a browser to totally fail to load the page in the case of a MITM that can block the OCSP servers is Chrome's CRLSets. Only a limited set of revocations are included due to space constraints though; mostly EV certs from select CAs and Intermediate CA certs.

A good solution to this problem would be short lived certificates, but that idea has yet to find much traction.

http://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-shortliv... http://dev.chromium.org/Home/chromium-security/crlsets http://blog.spiderlabs.com/2011/04/certificate-revocation-be...

Reply on news.ycombinator.com