On: F-Droid site certificate expired

[kxxt]

It's because CRLs/OCSP sucks so now short expiration is rolling out.

[ozim → kxxt]

CRL doesn’t suck it is just not easy problem on web scale.

But seems like there is feasible solution: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...

[aaomidi → ozim]

AKA they suck in this context

[ozim → aaomidi]

Was CRL designed with this context in mind?

[aaomidi → ozim]

Doesn’t matter. I think we’re fighting semantics.

Certificates are cached trust, and all the cache busting problem applies here.