3 ms·

Thanks for pointing this out! Going through the documentation, another thing that surprised me was the SSLStaplingStandardCacheTimeout setting. If I understan

by avian 9y ago

Thanks for pointing this out! Going through the documentation, another thing that surprised me was the SSLStaplingStandardCacheTimeout setting. If I understand this correctly, by default Apache will only cache OCSP responses for 1 hour, even if they are still valid for days. I guess increasing this to 1 day or something would make sense as well.

hannob 9y ago
> If I understand this correctly, by default Apache will only cache OCSP responses for 1 hour, even if they are still valid for days. I guess increasing this to 1 day or something would make sense as well. Yeah, that's another major problem. But increasing that doesn't really fix anything in a reasonable way. There shouldn't be any cache timeout, this option doesn't make any sense. It should cache as long as the reply is valid and replace it in time before it expires.
- avian 9y ago
  By the way, I checked the source and it appears that setting SSLStaplingStandardCacheTimeout to a large value (larger than typical OCSP reply validity) effectively creates this behavior. Apache checks if cached reply is still valid and if it's not it attempts to renew it. At least in 2.4.10 shipped in Debian Jessie. Relevant code is in modules/ssl/ssl_util_stapling.c, stapling_cb()