Thread by @dotMudge

On ‘names are hard’, X509 Distinguished Names (DN) can be a downright minefield.

Consider military (gov) where rank is part of the distinguished name field.

So what happens when someone gets a pay raise (get’s promoted)?

Each time that happens the DN changes which means...

https://twitter.com/leakissner/status/1066761697254289408

The old certificate needs to be revoked.

Onto the certificate revocation list it goes...

New digital certificates are issued, access cards re-provisioned, CAs updated (and eventually synchronized).

Life goes on...

But what happens to the certificate revocation list (CRL)?

According to Wikipedia there were over 17 million Common Access Cards issued by 2008.

That’s a decade ago and there are ~1.4 million people in the US military this year alone (according to Google). Don’t forget that we’re talking about a lot more than just military people...

Think about the sheer size of the revocation list over the years with every promotion and every person entering and leaving public service being an entry.

So what is the solution?

My understanding is that this motivated creation of the Online Certificate Status Protocol (OCSP).

That gets traced back to RFC 2560 from the PKIX working group in 1999.

Which implies the US Govt. figured out the hard way, pre 1999, that names are hard.

Especially when you use them as key components in large systems.

Won’t be the last time.

/HT @LeaKissner - thanks!