logoalt Hacker News

bawolff • yesterday at 6:02 PM • 1 reply • view on HN

There is a good reason they did. CRL and especially OCSP are both terrible and not particularly effective


Replies

quotemstr • yesterday at 9:28 PM

OCSP stapling works fine technically, which is one reason it's still available in both browsers via enterprise policy. LE dropping support for it and browsers having insufficient courage to hard-fail doesn't make the model broken. It instead makes the ecosystem broken.

Just another step towards a tiny number of browser vendors and infrastructure companies controlling the internet.