Embed Notice

@dalias I am not sure I agree. There may be some legitimate interest in a shorter time to reduce CRL size, but also certificates should in most cases be revoked if a domain is transferred to an unrelated party. The status quo is even worse, forcing people to age domains and make guesses.

Also, what the registrar says is the literal source of record for domain ownership.

But with DANE, this would all happen automatically and certificate expiration would just not be a thing.