Post #2603609

2026-04-12 01:20 UTC

@projectgus@aus.social @pl@mastodon.social I did find the following in Vanadiums feature list. So not sure why it shows it as valid. "Nearly all remote services disabled by default or removed. Only connects to GrapheneOS servers by default. There are only 2 default services: component updates such as certificate authority and certificate revocation updates and DNS-over-HTTPS connectivity checks when enabled"

Replies (1)

@projectgus@aus.social 2026-04-12 01:47

@markisherwood@kind.social @pl@mastodon.social Hmm, yeah. Vanadium does fine when the cert is revoked via OCSP i.e. https://revoked.grc.com/ And Lets Encrypt doesn't support OCSP at all since last year, meaning CRL revocations only. There are a lot of old posts claiming that Chromium & WebView for Android don't support CRL revocation at all. I can't find any recent confirmation of whether that's still the case. But that would be a simple explanation. A more nuanced possibility is that the cert's CRL URL is HTTP (true in this case and most cases) and is therefore being blocked by a no-cleartext policy at some layer. There's a description of that pattern in this (otherwise unrelated) comment https://github.com/rustls/rustls-platform-verifier/pull/179#issuecomment-2971944947 I'm now 100% procrastinating on going outside, so I'm going to go outside instead of either installing Chrome or reading Chromium source code. 😆

Open ##2603610