On Fri, Aug 08, 2008 at 02:08:37PM -0400, Perry E. Metzger wrote: > The kerberos style of having credentials expire very quickly is one > (somewhat less imperfect) way to deal with such things, but it is far > from perfect and it could not be done for the ad-hoc certificate > system https: depends on -- the infrastructure for refreshing all the > world's certs every eight hours doesn't exist, and if it did imagine > the chaos if it failed for a major CA one fine morning. The PKIX moral equivalent of Kerberos V tickets would be OCSP Responses. I understand most current browsers support OCSP. > One also worries about what will happen in the UI when a certificate > has been revoked. If it just says "this cert has been revoked, > continue anyway?" the wrong thing will almost always happen. No doubt.
