3 ms·
FWIW Apache has a new stapling implementation that is not suffering from all the major problems the old one did. Can be activated with "MDStapling on".
by hannob 6y ago
FWIW Apache has a new stapling implementation that is not suffering from all the major problems the old one did. Can be activated with "MDStapling on".
- tialaramex 6y agoThanks, that's good to know. I also read their documentation explaining why they couldn't (or at least didn't) fix the old one. I will try to publicise this rather than simply saying the Apache httpd OCSP stapling is garbage in future. It explicitly mentions two big flaws with the old one, but not the one most relevant here - out of the box Apache's old OCSP stapling would merrily staple BAD answers simply because they're newer, which makes no sense. I assume that's corrected, but if you know this'd be a good place to say.
- Apofis 6y agoShouldn't that be the default config option then?