Post #2603610

@markisherwood@kind.social @pl@mastodon.social Hmm, yeah. Vanadium does fine when the cert is revoked via OCSP i.e. https://revoked.grc.com/ And Lets Encrypt doesn't support OCSP at all since last year, meaning CRL revocations only. There are a lot of old posts claiming that Chromium & WebView for Android don't support CRL revocation at all. I can't find any recent confirmation of whether that's still the case. But that would be a simple explanation. A more nuanced possibility is that the cert's CRL URL is HTTP (true in this case and most cases) and is therefore being blocked by a no-cleartext policy at some layer. There's a description of that pattern in this (otherwise unrelated) comment https://github.com/rustls/rustls-platform-verifier/pull/179#issuecomment-2971944947 I'm now 100% procrastinating on going outside, so I'm going to go outside instead of either installing Chrome or reading Chromium source code. 😆