4 ms·

Why not simply add the Must Staple restriction unconditionally to all certificates (aka "status_request")? That will eliminate privacy concerns -- no compliant

Why not simply add the Must Staple restriction unconditionally to all certificates (aka "status_request")? That will eliminate privacy concerns -- no compliant TLS implementation should fetch a OCSP ticket given a stapled response -- while still allowing for broad non-browser support.

blahgeek 2y ago
I don't get the OCSP Stampling protocol: if the server needs / is able to to contact the CA frequently anyway, why not simply use very short-lived certificates?
- eqvinox 2y ago
  Issuing a certificate has significantly more overhead (e.g. Certificate Transparency logs) than signing a statement that an existing certificate is still valid.
- briansmith 2y ago
  Which CA's will issue short-lived certificates without negotiating a custom ($$$) contract with them?
  - agwa 2y ago
    Google Trust Services lets you go down to 1 day using ACME. No payment required.
  - kmeisthax 2y ago
    Let's Encrypt, they said a while back they want to allow issuing certs for fewer than 90 days.
    - schoen 2y ago
      That's true, although it's still not possible to actually get one yet.
mcpherrinm 2y ago
While it would eliminate privacy concerns, it would also likely break an enormous number of websites which don't implement OCSP stapling, or don't implement it correctly.
- eqvinox 2y ago
  I'd suggest making browsers soft-enforce it with e.g. a yellow URL bar, giving server operators a window of time to fix things.
  - nick238 2y ago
    I think with the whole menagerie of green locks, green bars & EV sites replacing/cluttering the address bar (meh [0]), only showing PSL+1 [1] (which actually does help security, but vocal power-users hate [2])...UI/UX designers are probably loathe to mess with it again. [0]: https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... [1]: https://blog.chromium.org/2020/08/helping-people-spot-spoofs-url.html https://blog.chromium.org/2020/08/helping-people-spot-spoofs... [2]: https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_stop_chrome_from_hiding_the_url_in_the/ https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_sto... [3]: https://www.wired.com/story/google-chrome-kill-url-first-steps/ https://www.wired.com/story/google-chrome-kill-url-first-ste...
    - Dylan16807 2y ago
      Does highlighting the domain name not give the boost in security? I don't mind highlighting. And it's possible to get very aggressive with highlighting. At the very least it should have a [...] and not completely hide the fact that there is a URL.
  - mcpherrinm 2y ago
    The browsers, generally, are not onboard with improving OCSP and supporting OCSP stapling. Chrome already doesn't check OCSP at all. Apple and Firefox are all working on out-of-band revocation information based on CRL data. Presumably Chrome and its family are going to go down that path too, but I'm not sure I've heard commitments from them yet. Firefox has the best documentation on what's happening: https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...
agwa 2y ago
Many web servers have terrible to nonexistent OCSP stapling implementations.
- eqvinox 2y ago
  This competes against terrible to nonexistent CRL checking on clients, but there are generally more clients than servers.
- darkhelmet 2y ago
  cough nginx. Nginx would start up and serve TLS on must-staple certs .. before doing the staple setup. ie: any client that validated that a must-staple cert had a stapled ocsp ticket would fail for the first few queries after nginx startup. I don't know if they've fixed it yet. I doubt it though - they were pretty aggressive in their assertion that violating must-staple wasn't a concern.
  - agwa 2y ago
    Yeah, I looked into nginx's stapling implementation almost a decade ago. I fixed some simpler bugs (I submitted a patch which was mostly rewritten and then merged) but fixing the problem you mention would have required major re-architecting. I doubt it has changed.
  - Nekit1234007 2y ago
    Well, this ticket is still open: https://trac.nginx.org/nginx/ticket/812 https://trac.nginx.org/nginx/ticket/812
  - Avamander 2y ago
    Apache as well, though mod_md improves on it significantly.
- Avamander 2y ago
  Couldn't that be circumvented by just turning OCSP responses an option available only for must-staple certificates?
citrin_ru 2y ago
In addition to listed below performance is another concern - OCSP stapling make TLS handshake large and slower. While it removes need for the client to query OCSP server itself in practice it such queries happen infrequently, asynchronously and in some may not happen at all. In theory a clients could include Certificate Status Request into the Client Hello only when a local cache expires but IIRC a few years ago Firefox did request OCSP on every TLS handshake making every handshake large if stapling is enabled on the server.
fiddlerwoaroof 2y ago
OCSP sounds to me like a really bad idea: certificate expiration is already a significant cause of issues and now we add a whole new way for certificates to break your site?
- ocdtrekkie 2y ago
  In practice, nothing breaks if it can't reach OCSP in a lot of cases. But as with most PKI systems, it causes problems sometimes, so we have to do stupid things like add firewall rules to allow secure systems to reach OCSP endpoints to avoid random PKI-dependent stuff coming crashing down.

blahgeek 2y ago

I don't get the OCSP Stampling protocol: if the server needs / is able to to contact the CA frequently anyway, why not simply use very short-lived certificates?

eqvinox 2y ago
Issuing a certificate has significantly more overhead (e.g. Certificate Transparency logs) than signing a statement that an existing certificate is still valid.
briansmith 2y ago
Which CA's will issue short-lived certificates without negotiating a custom ($$$) contract with them?
- agwa 2y ago
  Google Trust Services lets you go down to 1 day using ACME. No payment required.
- kmeisthax 2y ago
  Let's Encrypt, they said a while back they want to allow issuing certs for fewer than 90 days.
  - schoen 2y ago
    That's true, although it's still not possible to actually get one yet.

mcpherrinm 2y ago

While it would eliminate privacy concerns, it would also likely break an enormous number of websites which don't implement OCSP stapling, or don't implement it correctly.

eqvinox 2y ago
I'd suggest making browsers soft-enforce it with e.g. a yellow URL bar, giving server operators a window of time to fix things.
- nick238 2y ago
  I think with the whole menagerie of green locks, green bars & EV sites replacing/cluttering the address bar (meh [0]), only showing PSL+1 [1] (which actually does help security, but vocal power-users hate [2])...UI/UX designers are probably loathe to mess with it again. [0]: https://www.troyhunt.com/extended-validation-certificates-are-dead/ https://www.troyhunt.com/extended-validation-certificates-ar... [1]: https://blog.chromium.org/2020/08/helping-people-spot-spoofs-url.html https://blog.chromium.org/2020/08/helping-people-spot-spoofs... [2]: https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_stop_chrome_from_hiding_the_url_in_the/ https://www.reddit.com/r/chrome/comments/h11gde/how_do_i_sto... [3]: https://www.wired.com/story/google-chrome-kill-url-first-steps/ https://www.wired.com/story/google-chrome-kill-url-first-ste...
  - Dylan16807 2y ago
    Does highlighting the domain name not give the boost in security? I don't mind highlighting. And it's possible to get very aggressive with highlighting. At the very least it should have a [...] and not completely hide the fact that there is a URL.
- mcpherrinm 2y ago
  The browsers, generally, are not onboard with improving OCSP and supporting OCSP stapling. Chrome already doesn't check OCSP at all. Apple and Firefox are all working on out-of-band revocation information based on CRL data. Presumably Chrome and its family are going to go down that path too, but I'm not sure I've heard commitments from them yet. Firefox has the best documentation on what's happening: https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ https://blog.mozilla.org/security/2020/01/09/crlite-part-1-a...

agwa 2y ago

Many web servers have terrible to nonexistent OCSP stapling implementations.

eqvinox 2y ago
This competes against terrible to nonexistent CRL checking on clients, but there are generally more clients than servers.
darkhelmet 2y ago
cough nginx. Nginx would start up and serve TLS on must-staple certs .. before doing the staple setup. ie: any client that validated that a must-staple cert had a stapled ocsp ticket would fail for the first few queries after nginx startup. I don't know if they've fixed it yet. I doubt it though - they were pretty aggressive in their assertion that violating must-staple wasn't a concern.
- agwa 2y ago
  Yeah, I looked into nginx's stapling implementation almost a decade ago. I fixed some simpler bugs (I submitted a patch which was mostly rewritten and then merged) but fixing the problem you mention would have required major re-architecting. I doubt it has changed.
- Nekit1234007 2y ago
  Well, this ticket is still open: https://trac.nginx.org/nginx/ticket/812 https://trac.nginx.org/nginx/ticket/812
- Avamander 2y ago
  Apache as well, though mod_md improves on it significantly.
Avamander 2y ago
Couldn't that be circumvented by just turning OCSP responses an option available only for must-staple certificates?

citrin_ru 2y ago

In addition to listed below performance is another concern - OCSP stapling make TLS handshake large and slower. While it removes need for the client to query OCSP server itself in practice it such queries happen infrequently, asynchronously and in some may not happen at all. In theory a clients could include Certificate Status Request into the Client Hello only when a local cache expires but IIRC a few years ago Firefox did request OCSP on every TLS handshake making every handshake large if stapling is enabled on the server.

fiddlerwoaroof 2y ago

OCSP sounds to me like a really bad idea: certificate expiration is already a significant cause of issues and now we add a whole new way for certificates to break your site?

ocdtrekkie 2y ago
In practice, nothing breaks if it can't reach OCSP in a lot of cases. But as with most PKI systems, it causes problems sometimes, so we have to do stupid things like add firewall rules to allow secure systems to reach OCSP endpoints to avoid random PKI-dependent stuff coming crashing down.