Certificate revocation list
5
MENTIONS
3
EPISODES
3
PODCASTS
Search complete. 5 mentions across 3 episodes found for "Certificate revocation list".
Oct 20, 2026
Jesse OwenHOST
The disclosure doesn't establish that anyone's traffic was intercepted.
Jesse OwenHOST
Mozilla received the report on the 17th of October and says it's automatic one CRL block reached standard Firefox configurations that day.
Jesse OwenHOST
It's NOAA 20th of October releases extend protection to users whose custom settings prevented that update.
Jesse OwenHOST
That chronology matters.
Jonathan BennettHOST
You know, if, if a certificate was lost in the wild, you know, your, your server got popped and somebody pulled the cert off, well, you, you suddenly, you have this untrusted cert.
Jonathan BennettHOST
What do you do? Um, CRL was supposed to be the answer for that, certificate revocation list.
Jonathan BennettHOST
Because of the way it was implemented, most of the browsers weren't using it, and so basically everybody finally went, "Okay, fine.
Jonathan BennettHOST
We're not gonna do that anymore." And then, you know, if you have a certificate that lasts for 90 days and it gets popped halfway through it and you have no way to revoke it, we're all just in trouble.
Jonathan BennettHOST
Is there-
Jeff MassieHOST
Is my understanding.
Jonathan BennettHOST
Is there an alternative to CRL?
Jeff MassieHOST
Uh, I just remember Steve Gibson was talking about it, 'cause that was one of the things he was talking about, why are they doing this? Because now revocation works.
Jonathan BennettHOST
So what, what happened is, um- The certificate revocation list and OCSP, uh, were basically both failed experiments, and those were, those were, like, the two, um... those were the two ways that you could revoke a certificate.
Jonathan BennettHOST
You know, if, if a certificate was lost in the wild, you know, your, your server got popped and somebody pulled the cert off, well, you, you suddenly, you have this untrusted cert.
Jonathan BennettHOST
What do you do? Um, CRL was supposed to be the answer for that, certificate revocation list.
Jonathan BennettHOST
Because of the way it was implemented, most of the browsers weren't using it, and so basically everybody finally went, "Okay, fine, we're not gonna do that anymore." And then, you know, if you have a certificate that lasts for 90 days and it gets popped halfway through it and you have no way to revoke it, we're all just in trouble.
Jonathan BennettHOST
And so the, the thing now that, that the powers that be are moving towards are very, very short certificate lifespans.
Jeff MassieHOST
The reve- revocation now does work.
Jeff MassieHOST
Is my understanding.
Jonathan BennettHOST
Is there an, is there an alternative to CRL?