The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
14 views

OCSP stapling: Staple just my domain/root CRT, or Combine/Concatenate including Intermediates?

I cant seem to find a specific well documented resource on this question. Should I staple just my domain/root CRT, or staple my combined crt (Combine/Concatenate file which includes my root cert plus ...
1
vote
2answers
46 views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
7
votes
2answers
127 views

What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)

I just bought a certificate from RapidSSL. Looking up the chain, I found GeoTrust who is signed by Equifax. Then I realized that the ”Equifax Secure Certificate Authority” is due to expire on ...
-2
votes
1answer
53 views

Can OCSP stapling reduce or eliminate the weaknesses inherrent with OCSP? [closed]

Specifically, the problems with OCSP that Adam Langley talks about here?
2
votes
1answer
358 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
2
votes
1answer
62 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
0
votes
3answers
2k views

Secure connection failed (OCSP)

I've been getting a lot of failed connections lately, namely from Facebook and now Google (German site works, French does not). This happened to other sites as well but these two are the kind you ...
3
votes
3answers
249 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
4
votes
2answers
1k views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
0
votes
1answer
86 views

From where I can get a list of trusted certificates fo HTTPS?

I am using OpenBSD with a browser named Xombrero that doesn't have SSL certs by default. Should I get the certs from the /etc/ssl/certs.pem file? (ex.: I am not trusting OCSP and don't trust that my ...
3
votes
1answer
105 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
2
votes
1answer
695 views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
0
votes
1answer
1k views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
13
votes
1answer
3k views

How does OCSP stapling work?

I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...