3 ms·
The purpose of HTTPS is to defend again MITM attacks. An MITM attacker can effectively make the OCSP responder be down, by detecting and blocking traffic to it.
by ameliaquining 2y ago
The purpose of HTTPS is to defend again MITM attacks. An MITM attacker can effectively make the OCSP responder be down, by detecting and blocking traffic to it. So, no security.
- wkat4242 2y agoI can think of cases where an attacker can do one or not the other (in particular where they're intercepting traffic near the web server end, not the client). In those cases there is a benefit. Because the CA is not hosted by the server itself, the routing path is very different and only converges near the end user. I know it's less likely but to say that there is no security at all is not true in my opinion.
- ameliaquining 2y agoIf the attacker is between the server and the rest of the internet, they can pass a CA validation challenge and get a new certificate that way.