OneCRL primarily covers a security critical revocation of intermediates certificates, especially the compromised ones. Mozilla uses Kinto for distribution.
The OneCRL bundle as of today
|
Size |
| Records |
1,880 |
| Uncompressed (JSON) |
794.2 KiB |
| Compressed (Brotli) |
107.7 KiB |
* We can use the compression for transfer
Mozilla seems to be soft-deleting the revocation instead of deleting them using the Kinto mechanisms but if the size would become a concern we could always handle this on upki size by deleting the disabled records.
Analysis spanning the updates since 2024 (835 days)
Delta updates
Mozilla provides delta updates using Kinto.
| # |
Date (UTC) |
Records |
Size (KiB) |
| 1 |
2024-03-05 20:58 |
1 |
0.49 |
| 2 |
2024-03-11 20:06 |
5 |
1.90 |
| 3 |
2024-06-06 19:55 |
13 |
5.03 |
| 4 |
2024-09-25 16:01 |
21 |
8.12 |
| 5 |
2024-09-25 21:39 |
1 |
0.36 |
| 6 |
2024-09-26 20:09 |
7 |
2.81 |
| 7 |
2025-01-08 21:37 |
14 |
5.38 |
| 8 |
2025-05-21 00:15 |
15 |
5.76 |
| 9 |
2025-07-14 21:29 |
16 |
6.65 |
| 10 |
2025-08-11 20:06 |
1 |
0.40 |
| 11 |
2025-08-22 03:52 |
4 |
1.66 |
| 12 |
2025-08-25 21:14 |
11 |
4.34 |
| 13 |
2025-09-11 18:45 |
11 |
4.72 |
| 14 |
2025-09-26 22:15 |
10 |
3.76 |
| 15 |
2025-10-03 17:23 |
1 |
0.39 |
| 16 |
2025-12-10 17:13 |
16 |
6.93 |
| 17 |
2026-03-10 20:51 |
44 |
19.07 |
| 18 |
2026-03-26 19:45 |
6 |
2.32 |
| 19 |
2026-05-08 15:49 |
28 |
10.42 |
| 20 |
2026-06-11 22:15 |
37 |
15.01 |
| 21 |
2026-06-18 23:00 |
16 |
6.36 |
|
total |
278 |
111.89 |
Statistics
Total of 21 delta updates
| Metric |
Record count |
Size (KiB) |
| Mean |
13.24 |
5.33 |
| Median |
11 |
4.72 |
| Min |
1 |
0.36 |
| Max |
44 |
19.07 |
| Stdev |
11.58 |
4.81 |
The estimate is 9 updates a year with the total size of 0.05 MB.
Final thoughts
I think this could be a great addition to upki, increasing security marginally, while the cost of initial download of the bundle is pretty small and the subsequent delta updates straight up negligible as they are really small and few(for now at least). Unless there are no objections for integrating this I will:
- Implement the fetching/updating mechanism similar to CRLite.
- Implement the checking mechanism.
- Propose API for integrating this functionality(separate call/config option..?).
- Implement the API
OneCRL primarily covers a security critical revocation of intermediates certificates, especially the compromised ones. Mozilla uses Kinto for distribution.
The OneCRL bundle as of today
* We can use the compression for transfer
Mozilla seems to be soft-deleting the revocation instead of deleting them using the Kinto mechanisms but if the size would become a concern we could always handle this on upki size by deleting the disabled records.
Analysis spanning the updates since 2024 (835 days)
Delta updates
Mozilla provides delta updates using Kinto.
Statistics
Total of 21 delta updates
The estimate is 9 updates a year with the total size of 0.05 MB.
Final thoughts
I think this could be a great addition to upki, increasing security marginally, while the cost of initial download of the bundle is pretty small and the subsequent delta updates straight up negligible as they are really small and few(for now at least). Unless there are no objections for integrating this I will: