> It might even be sensible to intentionally revoke a small number of certificates every month, to make sure nobody is complacent.

No, this is not even remotely sensible.

▲

noitpmeder 6 hours ago | parent | next [-]

Failure paths that are not exercised with regularity will inevitably fail in surprising ways when actually needed.

▲

solarkraft 6 hours ago | parent | prev | next [-]

Please elaborate. Conventional thinking goes that emergency plans must be exercised to make sure they’re actually effective.

	▲	sam1714 5 hours ago \| parent [-]
		The problem isn't revocation of end-user identity certificates. There's hundreds of millions of those floating around at any given point, so revocation happens very regularly. The issue is revocation of intermediates and roots, which involves invalidating tens of millions of certificates and often find themselves in embedded/non-web applications (financial, legal signatures, medical data exchange). An analogy would be shutting down neighborhood streets versus shutting down major highways in a state for a hurricane evacuation. You can't test the latter at scale.

▲

sophacles 6 hours ago | parent | prev [-]

It really is. It's basically chaos monkey for pki.

Code paths and procedures that aren't exercised regularly are broken.

Even better is having a way to reoke keys and big players occasionally include revoked keys in trust chains and blast a warning if the revoked key is considered valid.