4 ms·

I’m not sure if this is affecting websites already having a certificate provided by Let’s Encrypt. I believe not.

pierrebeaucamp 5y ago
Just the issuing of new certificates
remram 5y ago
The OCSP responder being down could affect websites. https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...
- LinuxBender 5y ago
  FWIW people can mitigate that issue by using OCSP stapling [1] assuming their load balancer / web server supports caching the response. [1] - https://en.wikipedia.org/wiki/OCSP_stapling https://en.wikipedia.org/wiki/OCSP_stapling
  - hannob 5y ago
    Traditionally OCSP stapling implementations in the major webservers (nginx+apache) have been pretty bad and are not capable of mitigating OCSP server downtimes. Apache has a new stapling implementation since a few versions that can be enabled with "MDStapling On", I don't think it gets enabled by default yet.
    - mholt 5y ago
      Caddy has had a robust stapling implementation for years.
  - dlkmp 5y ago
    Does the caching reliably work in common webservers by now? I remember having read a couple years ago that Apache would simply clear its cache if the connection to the ocsp provider breaks (or did something similar unhelpful, resulting in an error to the enduser).
    - hannob 5y ago
      Very likely you read my blogpost. See the update at the top: https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-St...
    - mholt 5y ago
      Caddy does OCSP stapling + caching reliably (and has for years). It will even auto-renew your certificate if it gets an OCSP response of "Revoked".
    - LinuxBender 5y ago
      It's hit-and-miss per LB/server and I have not seen this become a priority since it's not a super popular feature. Here [1] [2] are a couple articles on the topic. My experience has been with HAproxy and F5 load balancers. HAProxy uses an out-of-band process to lay down a .ocsp file and load it via the API. This in effect acts like a cache assuming the script creating the .ocsp file has error handing to avoid clobbering the file if the upstream OCSP endpoint can not be reached. F5 load balancers will cache the response in memory. I have not tested Apache with OCSP stapling/caching recently so I can only assume based on feedback from others here that they have not improved it. I would expect nginx to improve now that they are owned by F5, maybe, eventually. I am a fan of OCSP stapling/caching for the privacy aspect. No need for browsers to leak to the OCSP end-point what domain you are visiting. There are enough nosy people sniffing our traffic already. [1] - https://www.keycdn.com/support/ocsp-stapling https://www.keycdn.com/support/ocsp-stapling [2] - https://blog.cloudflare.com/high-reliability-ocsp-stapling/ https://blog.cloudflare.com/high-reliability-ocsp-stapling/
- sneak 5y ago
  I imagine that, for still-valid certificates, it will almost always fail open.
pgporada 5y ago
We have been serving OCSP responses out of another datacenter since the initial status.io went up.

Just the issuing of new certificates

The OCSP responder being down could affect websites. https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...

LinuxBender 5y ago
FWIW people can mitigate that issue by using OCSP stapling [1] assuming their load balancer / web server supports caching the response. [1] - https://en.wikipedia.org/wiki/OCSP_stapling https://en.wikipedia.org/wiki/OCSP_stapling
- hannob 5y ago
  Traditionally OCSP stapling implementations in the major webservers (nginx+apache) have been pretty bad and are not capable of mitigating OCSP server downtimes. Apache has a new stapling implementation since a few versions that can be enabled with "MDStapling On", I don't think it gets enabled by default yet.
  - mholt 5y ago
    Caddy has had a robust stapling implementation for years.
- dlkmp 5y ago
  Does the caching reliably work in common webservers by now? I remember having read a couple years ago that Apache would simply clear its cache if the connection to the ocsp provider breaks (or did something similar unhelpful, resulting in an error to the enduser).
  - hannob 5y ago
    Very likely you read my blogpost. See the update at the top: https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-St...
  - mholt 5y ago
    Caddy does OCSP stapling + caching reliably (and has for years). It will even auto-renew your certificate if it gets an OCSP response of "Revoked".
  - LinuxBender 5y ago
    It's hit-and-miss per LB/server and I have not seen this become a priority since it's not a super popular feature. Here [1] [2] are a couple articles on the topic. My experience has been with HAproxy and F5 load balancers. HAProxy uses an out-of-band process to lay down a .ocsp file and load it via the API. This in effect acts like a cache assuming the script creating the .ocsp file has error handing to avoid clobbering the file if the upstream OCSP endpoint can not be reached. F5 load balancers will cache the response in memory. I have not tested Apache with OCSP stapling/caching recently so I can only assume based on feedback from others here that they have not improved it. I would expect nginx to improve now that they are owned by F5, maybe, eventually. I am a fan of OCSP stapling/caching for the privacy aspect. No need for browsers to leak to the OCSP end-point what domain you are visiting. There are enough nosy people sniffing our traffic already. [1] - https://www.keycdn.com/support/ocsp-stapling https://www.keycdn.com/support/ocsp-stapling [2] - https://blog.cloudflare.com/high-reliability-ocsp-stapling/ https://blog.cloudflare.com/high-reliability-ocsp-stapling/
sneak 5y ago
I imagine that, for still-valid certificates, it will almost always fail open.

pgporada 5y ago

We have been serving OCSP responses out of another datacenter since the initial status.io went up.