To be fair, it seems like they have a point that revocation is actually expensive for them.
back
1 comments
Where does it say that? I would assume it's just as easy as issuing them in the first place.
You would assume wrong. Revocation is a massive PITA.
Running a revocation service is an annoyingly fiddly job, but all of that needs to be setup and running before you become a CA. Pretty much all of the faffing around is in the need to regularly regenerate (including signing with the CA key) CRLs and OCSP responder certificates. Like the rest of a CA's operation, revoking an individual certificate should be a miniscule incremental cost, modulo the larger CRL size due to the added fingerprint. I was rather surprised that so many people are sucking down CRLs, but clearly they do (http://blog.cloudflare.com/the-hard-costs-of-heartbleed).
Why? It appears a CRL is nothing more than a file containing blobs of DER-encoded cert files.