2 ms·
Great article! Just the sort of thing I come to HN for. I note it's a year old, though - has much changed since then? OCSP stapling sounds like a Very Good Ide
by EvilTerran 10y ago
Great article! Just the sort of thing I come to HN for.
I note it's a year old, though - has much changed since then? OCSP stapling sounds like a Very Good Idea, I hope it's been catching on.
- pfg 10y agoNot all that much has changed. SSL Pulse[1] shows that use of OCSP Stapling went up about 3% in the past 12 months, currently putting it at 25% of observed sites. OCSP Must-Staple is now available in Firefox and can be added as an extension to certificates issued by Let's Encrypt. No other browsers have plans for Must-Staple AFAIK. Otherwise, OCSP is still soft-fail for everything but EV in most scenarios. [1]: https://www.trustworthyinternet.org/ssl-pulse/ https://www.trustworthyinternet.org/ssl-pulse/
- EvilTerran 10y ago+3%? Well, that's less inspiring news than I'd hoped. Still, it's something, I suppose. Anyway, that's another very interesting link you've got there - I knew about SSL Labs, but hadn't come across that report before. Looks like something worth keeping an eye on. Cheers!
- hannob 10y agoThe problem is that the major web server apache has basically a broken ocsp stapling implementation. It does a bunch of unexpected things and you'll likely not want to enforce stapling with it.