One possible tls change that isn't mentioned here:
Initially just send a hash of the intermediate signature. The client would keep a cache of intermediate certificates, and if it didn't already have the cert in its cache, then request the full signed intermediate cert.
The downside for that is that you have to maintain a cache, which would be difficult for some non-browser applications.
Initially just send a hash of the intermediate signature. The client would keep a cache of intermediate certificates, and if it didn't already have the cert in its cache, then request the full signed intermediate cert.
The downside for that is that you have to maintain a cache, which would be difficult for some non-browser applications.