Comment by bawolff
10 hours ago
There is a good reason they did. CRL and especially OCSP are both terrible and not particularly effective
10 hours ago
There is a good reason they did. CRL and especially OCSP are both terrible and not particularly effective
OCSP stapling works fine technically, which is one reason it's still available in both browsers via enterprise policy. LE dropping support for it and browsers having insufficient courage to hard-fail doesn't make the model broken. It instead makes the ecosystem broken.
Just another step towards a tiny number of browser vendors and infrastructure companies controlling the internet.