logoalt Hacker News

tgsovlerkhgseltoday at 6:01 AM1 replyview on HN

Revocation information may not be available for expired certificates. Not that it matters much because the last time I checked revocation didn't really work for non-expired certificates either, but I think that (+ the risk of people treating expired certificates as worthless and thus increasing the risk of exposure) is the main reason.

Also of course domains changing owners, but again... I don't think we have good monitoring for that during the current long lifetime, so maybe a grace period where a warning is shown but it's easier to click through would be a good idea. Perhaps combined with a requirement to keep revocation information (and keep revoking expired certificates) X days past expiry.


Replies

arcfourtoday at 8:17 AM

CRLs mostly still work for revoking non-expired certificates. They're a bit clunky, but they don't have to be: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...