Unverified50% confidenceTradeoffExact time
A custom certificate bundle specified via http.sslCAInfo requires tracking the certificate revocation list (CRL) or OCSP status oneself, and the configuration only applies to the current repository or globally to Git, without affecting other tools.
1
Sources
50%
Confidence
Long-term
Relevance
10/28/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedWhen a CA exits the business, if the CRL/OCSP services go offline early, clients will be unable to confirm certificate status, and some strict-mode browsers or systems may report errors directly.70% similarUnverifiedCommon certificate revocation mechanisms include certificate revocation lists (CRLs) and the Online Certificate Status Protocol (OCSP); browsers usually have built-in revocation checks or rapidly update root certificate lists, but system-level trust stores are updated less frequently, and many command-line tools do not perform real-time revocation queries by default.70% similarUnverifiedTo respond to an intermediate certificate private key leak, the standard practice is for the CA to add the leaked certificate to a revocation list (CRL) or mark it revoked via OCSP, and for relying parties to update their trust stores.69% similarUnverifiedApplications that ignore the system certificate store will throw errors such as UNABLE_TO_VERIFY_LEAF_SIGNATURE or self signed certificate in managed network environments.68% similarUnverifiedIn the PKI system, root certificates are usually kept offline and rarely issue end-entity certificates directly, while intermediate CAs handle day-to-day issuance duties.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1107835API
curl https://kongchang.com/api/v1/knowledge/claims/1107835MCP
get_claim(id=1107835)