Archivetls
Revocation Is Still the Weakest Link
CRLs are too big, OCSP leaks browsing, stapling helps until it does not. Plan for revocation failure explicitly.
- Published
- Reading time
- 1 min read
A certificate's lifetime is the real revocation mechanism. Everything else is best-effort, and the history is a graveyard of good intentions.
The options
- CRL: a signed list of revoked serials. Grows unbounded; clients often ignore or cache it too long.
- OCSP: per-certificate status query. Adds latency and leaks which sites a client visits to the CA.
- OCSP stapling: the server fetches and serves a signed status response. Removes the privacy leak but the server may staple stale data.
- Short-lived certificates: 90 days, then 7 days, then hours. This is where the industry is going.
The hard cases
Revocation fails exactly when you need it: the CA is down, the client cannot reach the responder, or the certificate was issued by a CA you no longer trust. Clients choose between failing open (availability) and failing closed (security).
Takeaway: shorten certificate lifetimes and automate renewal; treat revocation as a signal, not a guarantee, and test what your clients do when the check fails.