upki

@matthew_d_green rustls/upki may be part of it

@grhmc idea: plugin for rustls/upki that creates a virtual file system for things that dont integrate with it

@greatplainswest @tqbf rustls/upki is a project to do exactly this.

this is some work in that direction rustls/upki

More on upki: discourse.ubuntu.com My interest in building OneCRL support into upki has definitely increased this week. Issue: upki#229 I'm hoping some organizations will step forward to fund work on this. (Note that curl on Ubuntu 26.10 now has CRLite support baked via upki -- unfortunately that doesn't help with this because AIUI CRLite is only for end entities, not for intermediate certificates.)

The impact of this incident is very unevenly spread. Over 10 years ago, Mozilla shipped OneCRL [1]. We remediated this incident in a couple of hours for Firefox users who were protected automatically without the need for updates. Chrome, Apple and Microsoft have similar tooling. Since then, we've built more advanced tooling to handle revocation at scale for leaf certs (CRLite [2]). However, for the rest of the ecosystem, there has been little to no investment in revocation and for those clients, this is a massive problem. Hopefully, we'll see folks invest now. Efforts like upki [3] look promising. [1] blog.mozilla.org [2] hacks.mozilla.org [3] rustls/upki

@arstechnica One of the reasons why "upki" is needed (see "curl -sw '%{certs}' example.com | upki revocation check") rustls/upki