On 07/02/17 03:34, Eric Mill via Public wrote:
* No, not really. Expired certificates let you click-through while
revoked certificates are a hard fail, the way it should be (per Rob)
I don't think this (or Rob's original comment) are accurate as stated.
*If* revocation messages are presented, Firefox disallows clickthrough.
Hi Eric. I thought I'd captured that "*If*" in my original comment. :-)
I talked about "known revoked certs" - that is, certs that the user
agent knows to be revoked (which is likely to only be a subset of the
certs that the CA has actually revoked).
My point was simply that "known revoked certs" and expired certs should
ideally be treated the same way. My proposal was "Browsers shouldn't
allow it to be bypassed" for both cases, but Ryan's rebuttal
(https://cabforum.org/pipermail/public/2017-February/009482.html) is
persuasive.
<snip>
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
_______________________________________________
Public mailing list
[email protected]
https://cabforum.org/mailman/listinfo/public
