5 ms·

We just implemented perfect forward secrecy for https://commando.io https://commando.io this weekend on all of our nginx web servers (https://medium.com/devops-

We just implemented perfect forward secrecy for https://commando.io https://commando.io this weekend on all of our nginx web servers (https://medium.com/devops-programming/78e1acd80228 https://medium.com/devops-programming/78e1acd80228). The only thing we don't implement is OCSP stapling. How much of a security and performance increase is there to gain with it?

jvehent 13y ago
> How much of a security and performance increase is there to gain with it? The time it takes to establish a TCP connection to an OCSP responder, send a query, wait for a response, parse it and close the TCP connection. I think it's fair to say a few hundred milliseconds at the very least.
- deleted 13y ago
  [deleted]
- nodesocket 13y ago
  So it seems to be significant. Will implement OCSP stapling shortly. Thanks.
zobzu 13y ago
See http://en.wikipedia.org/wiki/OCSP_stapling http://en.wikipedia.org/wiki/OCSP_stapling
flylib 13y ago
"However, one optimization that can be made for some browsers is OCSP stapling: the server can include (staple) the OCSP response from the CA to its certificate chain, allowing the browser to skip the online check. Moving the OCSP fetch to the server allows the server to cache the signed OCSP response and save the extra request for many clients. However, there are also a few things to watch out for: OCSP responses can vary from 400 to 4,000 bytes in size. Stapling this response to your certificate chain may once again overflow your TCP congestion window—pay close attention to the total size. Only one OCSP response can be included, which may still mean that the browser will have to issue an OCSP request for other intermediate certificates, if it has not been cached already." http://chimera.labs.oreilly.com/books/1230000000545/ch04.html#_ocsp_stapling http://chimera.labs.oreilly.com/books/1230000000545/ch04.htm...

jvehent 13y ago

> How much of a security and performance increase is there to gain with it? The time it takes to establish a TCP connection to an OCSP responder, send a query, wait for a response, parse it and close the TCP connection. I think it's fair to say a few hundred milliseconds at the very least.

deleted 13y ago
[deleted]
nodesocket 13y ago
So it seems to be significant. Will implement OCSP stapling shortly. Thanks.

zobzu 13y ago

See http://en.wikipedia.org/wiki/OCSP_stapling http://en.wikipedia.org/wiki/OCSP_stapling

flylib 13y ago

"However, one optimization that can be made for some browsers is OCSP stapling: the server can include (staple) the OCSP response from the CA to its certificate chain, allowing the browser to skip the online check. Moving the OCSP fetch to the server allows the server to cache the signed OCSP response and save the extra request for many clients. However, there are also a few things to watch out for: OCSP responses can vary from 400 to 4,000 bytes in size. Stapling this response to your certificate chain may once again overflow your TCP congestion window—pay close attention to the total size. Only one OCSP response can be included, which may still mean that the browser will have to issue an OCSP request for other intermediate certificates, if it has not been cached already." http://chimera.labs.oreilly.com/books/1230000000545/ch04.html#_ocsp_stapling http://chimera.labs.oreilly.com/books/1230000000545/ch04.htm...