Hacker News Reader

Comment by tgsovlerkhgsel | Hacker News Reader

And Let's Encrypt actually provides an API for this: https://letsencrypt.org/docs/revoking/#using-a-different-aut...

I don't think it makes a significant difference (I believe browsers don't implement revocation in any meaningful way), but the option exists.

View on HN

Lots of browsers avoid it for reasons, but isn't this the whole point of the OCSP(https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Pr...) and OCSP stapling?

Yes, protocols for this exist... but as you said, browsers tend to avoid them.

Edit: Firefox seems to check revocation by default. https://revoked.badssl.com/ if you want to test.

This requires the certificat's private key, right? Can you download the key for letsencrypt certificates generated by cloudflare?

No, if you can complete challenges for every DNS name in the certificate then the API lets you revoke it.

No, as the section I linked explains, you can also prove that you own the domain and then revoke the cert without having the private key. It's meant exactly for cases where some other party has obtained a cert for your domain for whatever reason (change of ownership, compromise, ...)

Firefox does do revocation.

Huh, you're right - it also seems to be enabled by default. I tried with a clean profile and https://revoked.badssl.com/ showed an error (Chrome loads the page).

iOS Safari also shows an error and refuses to load the page.

Reply on news.ycombinator.com