crls

However, it's clear that /someone/ is downloading CRLs because Cloudflare are spending half a million dollars a month[3] to serve Globalsign's CRLs.

I thought I'd heard about CRLs megabytes long, but Google Chrome seems heavily curated re: CRLs.

It just means any attacker dedicated enough can work around the CRLs.

Does it bother anyone else that the links Amazon provided to their certificates and CRLs are not https?

Typical example: Certificate authorities distribute CRLs primarily through untrusted channels and third parties to lower their operating cost.

But CAs know this and /split/ their CRLs so that they don't get hit with huge bandwidth bills.

But for people who do enable CRLs, they'll see the scary warning rather than their browser trusting the revoked cert.

If you want your CRLs to be fresher, use a smaller X, have more CDPs.

CRLs are way too large to distribute through the DNS (e.g.

I agree with the broad conclusion that CRLs aren't effective for human trust, but they are perfectly reasonable for machine trust.

The CRLs are signed so its a win-win for everybody.

It would lower the costs associated with distribution of CRLs...

CRLs solve the "He was Spartacus" problem.