3 ms·

Looks valid on my machine (win10, chrome)

• cbsks 8y ago
  Safari on iOS does not trust the certificate
  • brandonjm 8y ago
    Safari, Chrome and Firefox all do not trust it on macOS as well.
    • saagarjha 8y ago
      My Safari does, to give another viewpoint.
• segfaultbuserr 8y ago
  Because OCSP is not reliable. Yeah, SSL/TLS is still broken at large, can you believe it, by default, there is NO reliable way to revoke a certificate... If OCSP times out, it just times out, the browser simply ignores it and loads the page without warnings. Active attackers can just block the OCSP server before they can use a revoked certificate with leaked private key to launch a MITM attack. This is why we need OCSP pinning and OCSP Must Staple. OCSP pinning makes the web server itself to delegate OCSP responses in-band, thus eliminates the need for clients to make an unreliable connection to a 3rd-party, improves both security and performance. OCSP Must Staple is a certificate attribute that forces the browser to enforce pinned OCSP checkings. This is also the reason that Let's Encrypt limits the certificate lifetime to 90 days.