this post was submitted on 19 Feb 2022
6 points (100.0% liked)
Security
5005 readers
2 users here now
Confidentiality Integrity Availability
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
For HTTPS you can rely on local CA-Certificates perfectly which are upgraded by the OS.
The problem is that your offline CA stores won't use OCSP revocation logs or certificate transparency. You need live updates for those. The latter is especially important, as without it you're completely dependent on one group of CAs.