Caching CRLs in TypeScript

Some time ago, I had to implement revocation checks for X.509 certificates. A problem that wasn’t really clear at the beginning was how heavy parsing CRLs can be. This started showing when I was trying to parse some CRLs from the EU that were larger than 10MB, in TypeScript. While TypeScript may not be the ideal language to parse raw byte data and do operations on it, it was the language we were using for the whole platform and the libraries, so that’s what we had to use. For the parsing itself we used Peculiar Ventures’ X.509 library, which has been serving us well for quite some time. The checks live in the library, Credo, not the product, so every Credo user gets correct checks. Either way, every time you need to check if a certificate is revoked, you need to check its CRL, which you need to fetch. Fortunately, CRLs are not updated very often, so you can leverage that and cache them. But caching the CRL is not enough. You need to cache the right information to make the right…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town