9 thoughts on “Revocation repositories, IPv6 support, message size, and performance”

1. Kouett' June 28, 2012 at 6:30 am

   Nice job. IPv6 is a bonus.

   CRL size is wrong for GlobalSign (1144 instead of 114) and for GoDaddy (remove the trailing ‘a’ in the URL to get the real one).
   CRL #entries should really be counted (openssl crl … | grep -c “Serial Number:”), because CRL entry sizes vary a lot. For example GeoTrust uses 2 bytes serial numbers (sequential, which must have been prohibited since 2008 at least), while Certum uses 16bytes ones with a reason code for each entry.

   Reply ↓
2. Kouett' June 28, 2012 at 6:31 am

   (Why is the “website” entry mandatory for comments?)

   Reply ↓
3. rmhrisk Post authorJune 28, 2012 at 8:24 am

   I fixed the table, copy and paste errors 🙁

   As for the CRL count, I agree its just an apx, no time to fix right now.

   Reply ↓
4. rmhrisk Post authorJune 28, 2012 at 8:26 am

   As for the website, Its the default I will look into it.

   Reply ↓
5. rmhrisk Post authorJuly 1, 2012 at 12:10 am

   Fixed the CRL counts.

   Reply ↓
6. techniq808 July 25, 2012 at 6:50 pm

   I noticed you mentioned Comodo’s CRL was available via IPv6, however I’m finding the CRLs accessibility over IPv6 very inconsistent. i noticed this when working with a PDF file signed with a client cert issued by Comodo. Several test with curl confirm the same, no failures over IPv4 (20/20) and IPv6 could only do 60% (12/20). The 60% was the best for IPv6 other test runs fared worse. Just for comparison accessing GlobalSign’s CRL over IPv6 was perfect (20/20) over multiple iterations.

   Reply ↓
7. VICTOR ALVARADO October 19, 2015 at 1:08 pm

   Hi,

   I was told that GlobalSign was the first one in getting this. But…is there any other one compliant? What about COMODO? Symantec? I found some info about those 2 being compatible.

   Any update on this?

   Is there a public .org or .com page from a regulatory institution who can confirm this?

   Best regards

   Reply ↓
   1. rmhrisk Post authorOctober 19, 2015 at 1:14 pm

      Yes, we were (I am no longer with them) I have not checked in some time but I know that several others are now using CDNs for distribution so in theory they too should be available over ipv6 even if their networks are still IPv4. Unfortunately you will have to check case by case as the report I used to produce for this needs too much work to check easily sorry.

      Reply ↓

8. Pingback: IPv6 Support by Certificate Authorities (CAs) - Infoblox Blog