r/PKI

Apparently if your CRLDP end point doesn't set max-age in the response header browsers may use a heuristic method to guesstimate how long to cache it, like (current date - last modified date) / 10. What this means practically is that if say your root CA CRL is refreshed once a year, if a client happens to download it at the wrong time, the browser will consider the cached file to be fresh even if current date is past the NextUpdate date set on the CRL (and remember Chromium browsers don't use CAPI2 to handle CRLs anymore).

So basically in addition to the intended RFC5280 mechanisms for determining when to refresh the cached CRL, it's also subject to browser-side rules on how long to cache files, since CRLs are handled like any other downloaded content under Chromium.

Hello,

I'm a student researching PQC migration problems to understand migration workflows. I understand that prominent platforms already handle crypto discovery, CBOM generation, risk assessment, dashboards, and in some cases remediation.

After an organization identifies quantum-vulnerable cryptography, what is the hardest part of migration?

For example, is it typically:

• Legacy systems and unsupported applications
• Hybrid deployment and backward compatibility
• Third-party dependencies or vendor-managed systems
• Performance, key/signature sizes, or bandwidth impact
• Testing and verifying that changes do not break applications or integrations
• Deployment constraints

What approaches are organizations using today to handle these problems?

I'd really appreciate it if you could reference concrete examples, case studies, or references.

Thank you!