sesh / ready

Are you production ready?
ISC License
26 stars 4 forks source link

feat: short-lived certs always pass OCSP checks #42

Open Seirdy opened 3 months ago

Seirdy commented 3 months ago

Firefox skips OCSP checks for certs younger than the number of days specified in security.pki.cert_short_lifetime_in_days (10 by default), which makes sense because OCSP stapling is redundant for short-lived certs. Revocation is only applicable to long-lived certs with lifetimes measured in weeks or longer.

Ready now exhibits the same behavior.