mozilla / crlite

WebPKI-level Certificate Revocation via Multi-Level Bloom Filter Cascade
http://www.cs.umd.edu/~dml/papers/crlite_oakland17.pdf
Mozilla Public License 2.0
70 stars 8 forks source link

Update enrollment only when a full filter is published #227

Closed jschanck closed 2 years ago

jschanck commented 2 years ago

To reduce the risk that clients' issuer enrollment list gets out of sync with the published filter, we should only update enrollment when a full filter is published. We should also check that the enrollment status in the intermediates collection matches what's in cloud storage as part of the sign-off process. Additional changes will be made client-side under Bug 1750787.