I am trying to see if I can watch the traffic that is sent and received when a browser checks for CRLs. All I can see with the latest version of Firefox is setting for OCSP. I dont see anything where I can force it to check CRLs. Is this something that Firefox doesn't give control of?
1 Answer
Firefox has moved some time ago to use only OCSP and no longer CRL:
As of Firefox 24, the user-interface for importing CRLs via Firefox has been removed. Auto-importing/updating of CRLs through Firefox has also been removed. NSS still supports CRLs, but Firefox is moving away from checking CRLs, and moving towards using a revocation list push mechanism.
-
So Firefox doesn't use CRLs and only relies on OCSP? Or does it do CRLs depending on the certificate? In short is CRL checking non existent in Firefox?– user1720897Sep 10, 2014 at 5:33
-
I guess as per [this][1] article, "The latest version of Firefox removed the last vestiges of CRL checking: previously CRLs were checked only for EV certificates when OCSP failed." [1]:news.netcraft.com/archives/2014/04/24/…– user1720897Sep 10, 2014 at 5:54
-
I've edited the response to make it clearer, that OCSP is the only way now. Sep 10, 2014 at 6:43