On Mon, Feb 6, 2017 at 3:40 AM, Rob Stradling via Public < [email protected]> wrote:
> Is there anyone who believes that _expiration_ currently "works"? > > When a typical browser encounters an expired server certificate, it shows > a warning that the user can click through. The user is only advised to > avoid harm. I wonder how many users don't heed that advice? > > However, when a typical browser encounters a server certificate that it > knows to be revoked, it shows a warning that the user *cannot* click > through. The user is *forced* to avoid harm. > > What's stopping browsers from treating expired certs in the same way that > they treat known revoked certs? > > (FWIW, I've made this point before: > https://groups.google.com/d/msg/mozilla.dev.security.policy/ > T11up58JkFc/uMNrXQsIzf0J) Perhaps it's worth starting a separate thread for that discussion? And perhaps it's worth reviewing https://docs.google.com/presentation/d/1Qmpl-5epx0B5C2t4XsUTyjgbwab_rXfK_4iHqX3IC30/pub?start=false&loop=false&delayms=3000&slide=id.gf44795496_0_1 from last year's Real World Crypto as well?
_______________________________________________ Public mailing list [email protected] https://cabforum.org/mailman/listinfo/public
