3 ms·
Many web servers have terrible to nonexistent OCSP stapling implementations.
by agwa 2y ago
Many web servers have terrible to nonexistent OCSP stapling implementations.
- eqvinox 2y agoThis competes against terrible to nonexistent CRL checking on clients, but there are generally more clients than servers.
- darkhelmet 2y agocough nginx. Nginx would start up and serve TLS on must-staple certs .. before doing the staple setup. ie: any client that validated that a must-staple cert had a stapled ocsp ticket would fail for the first few queries after nginx startup. I don't know if they've fixed it yet. I doubt it though - they were pretty aggressive in their assertion that violating must-staple wasn't a concern.
- agwa 2y agoYeah, I looked into nginx's stapling implementation almost a decade ago. I fixed some simpler bugs (I submitted a patch which was mostly rewritten and then merged) but fixing the problem you mention would have required major re-architecting. I doubt it has changed.
- Nekit1234007 2y agoWell, this ticket is still open: https://trac.nginx.org/nginx/ticket/812 https://trac.nginx.org/nginx/ticket/812
- Avamander 2y agoApache as well, though mod_md improves on it significantly.
- Avamander 2y agoCouldn't that be circumvented by just turning OCSP responses an option available only for must-staple certificates?