The problem isn't revocation of end-user identity certificates. There's hundreds of millions of those floating around at any given point, so revocation happens very regularly. The issue is revocation of intermediates and roots, which involves invalidating tens of millions of certificates and often find themselves in embedded/non-web applications (financial, legal signatures, medical data exchange).
An analogy would be shutting down neighborhood streets versus shutting down major highways in a state for a hurricane evacuation. You can't test the latter at scale.
None of the test certs would be used for real, whether they're intermediate or leaves.
They'd be created with big red warning signs, installed into browsers and other places by anyone who wants to test, and then publicly revoked every month. Rinse, repeat.
You can do that, and I'm sure people already do. But you can't truly test things at scale. Are OCSP servers going to get overloaded? What about IoT devices and things out of support? You have deployments which configure their systems in non-standard ways, maybe some corporate manager decided to mandate cert pinning.
The original comment was to do a fire drill and revoke live certificates to force everybody to participate in the test.
You can have a fire drill and evacuate an office building, but you can't hold a full-scale forest fire/volcano/hurricane drill and evacuate 3.5 million people to test mass evacuation routes, and also you got the edge cases that don't participate in drills, like homebound seniors or hospitals, where disaster strikes.
> I'm sure people already do. But you can't truly test things at scale.
Do they, actually? I got the impression from the article that little revocation testing of any scale happens. If so, then even a limited test would be useful.
An analogy would be shutting down neighborhood streets versus shutting down major highways in a state for a hurricane evacuation. You can't test the latter at scale.