[fastest963]

How many people are going to check that box under "Advanced Settings"? 0.1%?

[scrollaway]

Unlikely to be that high. The 0.1% that may dig in those advanced settings is likely the same 0.1% that disabled the thing back when it was enabled by default. CRLs are worthless.

[fastest963]

Worthless except when your cert key is stolen and you want to revoke the old one?

[sp332]

What good is it to revoke one, if it still works because no one checked the revocation list?

[fastest963]

That's the whole point of me posting this...

[iancarroll]

How are they worthless?

[msherry]

They're worthless because clearly no one is using them. They may theoretically be useful, but it doesn't matter if they're never put into practice.

[iancarroll]

Do you mean nobody on the CA side or the end user side? CA's suspend certificates all the time - instant e the scam site had theirs pulled a few weeks ago...

[nullc]

Beyond being seldom used, they also leak usage information.

[dfc]

If you are leaking usage information with ocsp/crl checks you are also spewing out information via DNS requests.

[snogglethorpe]

Still, having that setting there means you can easily tell people to turn it on...