4 ms·
I should note that blocking OCSP requests will not cause revoked.grc.com to function. The server is using OCSP stapling, which means the OCSP certificate is be
by pstrateman 13y ago
I should note that blocking OCSP requests will not cause revoked.grc.com to function.
The server is using OCSP stapling, which means the OCSP certificate is being sent directly by the https server, an attack would obviously not be sending an OCSP response indicating the certificate was revoked....
- eurleif 13y agoWhy does OCSP stapling even exist?
- pstrateman 13y agoBecause querying the OCSP servers directly results in a crazy amount of traffic. Implemented in the most paranoid manner possible every https request would result in an OCSP request. That would be millions of requests per second for a large CA. They have effectively no financial interest in actually supporting that.
- __david__ 13y agoMore importantly, it removes the privacy leak from client to CA, since the client is no longer speaking to the CA directly (it just has to look at the signature).