I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the encryption is "broken and insecure".
I then ran an HTTP analyzer on the requests from the HTTPS AmEx log in page and found the following:
POST http://ocsp.verisign.com/ GET http://ad.doubleclick.net/crossdomain.xml POST http://evintl-ocsp.verisign.com/ POST http://evsecure-ocsp.verisign.com/
These 4 requests are, from what I can tell, the cause of the SSL warnings I'm seeing. The Verisign requests look to be checking the status of the issued cert and the cross-domain request for DoubleClick is getting the cross-domain policy info.
Are these requests putting the SSL connection at risk by being over HTTP? I noticed none are sending any AmEx cookies.
Is checking the certificate status via an insecure HTTP OCSP POST safe to do during an SSL connection?