Skip to content

Revocation & The Future of High-Assurance

Early versions of this service attempted to maintain massive, highly-available caches of CRLs and OCSP responses (using AWS ElastiCache). This proved to be an infrastructural black hole. The VSS architecture has since evolved to shed this technical debt, relying entirely on the native JRE PKIX engine for end-entity validation and leaning into the industry push for shorter certificate lifetimes.

Federal PKI vs. CABForum

While the CABForum is actively pushing to eliminate OCSP in the long term, the U.S. Federal PKI (FPKI) is less likely to follow the same trajectory in the near future. Federal implementations continue to rely heavily on a combination of:

  • OCSP (Online Certificate Status Protocol): For real-time, lightweight status checks.
  • CRL (Certificate Revocation Lists): For high-assurance, offline-capable, and aggregate revocation checking.

VSS maintains compatibility with both mechanisms through its underlying Java PKIX implementation.

Engagement & Contributions

I am actively seeking collaborators and developers who are interested in optimizing revocation checking within the VSS ecosystem.

For more details on how to get involved or to reach out directly, please see the Contact Information page.