2 ms·

They are so complex, and in practice unreliable, that my employer runs a caching proxy for our (non-browser) users (they mostly don’t want fail open). IMO it i

by lokar 2y ago

They are so complex, and in practice unreliable, that my employer runs a caching proxy for our (non-browser) users (they mostly don’t want fail open). IMO it is unfixable and should go

hsbauauvhabzb 2y ago
I don’t understand what relevance your caching proxy has. if you have time, are you able to explain this a bit further?
- lokar 2y ago
  The CA ocsp endpoints are so unreliable we have to run a cache (the sdk we provide will use it).
- Avamander 2y ago
  Relying on OCSP alone client-side is simply too unreliable, either the responses have to be cached client-side or the server has to do stapling.