Certificate Revocation in action

[EdwinG]

So... one of the major ISPs in Canada has (had) its www certificate revoked.

When you visit https://www.bell.ca/ (as of posting on 2023-03-23 18:46 UTC) using a browser different than Google Chrome, you get the error below (here, Microsoft Edge).

Just funny.

Credit to: NeilN over at DigitalHome Forums for finding this

 

[Darcon]

Steve had a few episodes (and even mentioned it recently with the 90 day TLS certificate life) that Chrome does not handle certificate revocation properly. Chrome has an internal list of certificates that are revoked, and it never sees actual live revocations.

Steve proved this by revoking one of his certificates, and all the browsers except Chrome recognized it. Chrome added this certificate to their internal list of revoked certificates to avoid the negative perception, so Steve created a new one and revoked that again to show the problem still exists. Chrome never bothered to add this second certificate to the internal list.

Chrome is the more dangerous browser to use IMHO which is why it is not installed on any of my systems. Maybe the variants (Vivaldi, Edge, Opera, Brave,...) are using real revocation lists, unless your Edge was not updated to the Chromium version.

People that I support MUST use Firefox or find someone else to help them with their computer issues.

 

[EdwinG]

Steve had a few episodes (and even mentioned it recently with the 90 day TLS certificate life) that Chrome does not handle certificate revocation properly. Chrome has an internal list of certificates that are revoked, and it never sees actual live revocations.

Steve proved this by revoking one of his certificates, and all the browsers except Chrome recognized it. Chrome added this certificate to their internal list of revoked certificates to avoid the negative perception, so Steve created a new one and revoked that again to show the problem still exists. Chrome never bothered to add this second certificate to the internal list.

Chrome is the more dangerous browser to use IMHO which is why it is not installed on any of my systems. Maybe the variants (Vivaldi, Edge, Opera, Brave,...) are using real revocation lists, unless your Edge was not updated to the Chromium version.

People that I support MUST use Firefox or find someone else to help them with their computer issues.

It‘s the Chromium-based Edge on Windows.

I can also confirm that Firefox on Windows, Safari on macOS and iOS all prevented accessing bell.ca (which, for completeness purposes, is one of the big three ISPs).

I’m aware how the certificate révocation feature on Chrome is broken, and I understand their position. I’m not sure if I find it more disappointing or sad.