<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
You nailed it Kirk, excellent! As such the risks for short-lived
certificates remains and doesn't go away really, but that's another
issue.<br>
<br>
<div class="moz-cite-prefix">On 10/28/2014 01:43 AM,
<a class="moz-txt-link-abbreviated" href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a> wrote:<br>
</div>
<blockquote
cite="mid:EF70381B2D29784EA4FC66042BE81EAF4017EC99@SJDCEXMBX02.us.trendnet.org"
type="cite">
<pre wrap="">Gerv, I've pasted in your original response to this question below.
If I can summarize, you don't want revocation pointers in new "short lived certs" as defined because legacy browsers and apps (i.e., every browser and app in use today) will continue to check for revocation information, thereby lowering the benefit of this new type of cert. (You estimated 90% will still check for revocation -- but is that number realistic under Google's and Mozilla's current revocation checking processes? I thought revocation checking was already omitted today for many long-lived certs...)
My question back is: how long would it take Firefox and Google (and other interested browsers) to modify your browser software as Tim and Rich have suggested - ignore revocation pointers if the cert is a short lived cert? And how quickly would those code changes get distributed to your users?
The burden of revocation checking falls mostly on CAs, and it can only get better (fewer revocation checks) if some browsers decide not to check revocation for (self-designated) short lived cert by modifying their software. So why not just move forward as browsers to do this? The revocation checking burden on CAs that decide to start issuing short-lived certs would not go up as compared to current long lived certs, and over time (maybe quickly) would go down.
Having said that, Trend Micro is not yet convinced this is a good idea for the reasons stated by others -- but the browsers don't have to wait if they think the risk from eliminating revocation checking for short lived certs is acceptable.
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>