The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
55 views

OCSP stapling implementation in JAVA/ Android

I am trying to implement OCSP stapling in JAVA. How can this be implemented ? How can we set OCSPStatusRequest extension for TLS. and how we can verify the response ? Hi, How can we implement OCSP ...
2
votes
1answer
74 views

Can I modify my certificate chain?

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP ...
2
votes
0answers
54 views

OCSP responder penetration testing

I have to do penetration testing on an OCSP responder. Are there any frameworks for OCSP pentesting? since it does not include any web applications to test, should I only run network penetration tests ...
6
votes
2answers
2k views

SSL/TLS: How to fix “Chain issues: Contains anchor”

I just ran a quick test at ssllabs.com: got A+, which I'm happy about. However there's one thing I don't know how to "fix": My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: ...
0
votes
0answers
43 views

OCSP stapling: Staple just my domain/root CRT, or Combine/Concatenate including Intermediates?

I cant seem to find a specific well documented resource on this question. Should I staple just my domain/root CRT, or staple my combined crt (Combine/Concatenate file which includes my root cert plus ...
2
votes
2answers
1k views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
8
votes
2answers
707 views

What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)

I just bought a certificate from RapidSSL. Looking up the chain, I found GeoTrust who is signed by Equifax. Then I realized that the ”Equifax Secure Certificate Authority” is due to expire on ...
-2
votes
1answer
61 views

Can OCSP stapling reduce or eliminate the weaknesses inherrent with OCSP? [closed]

Specifically, the problems with OCSP that Adam Langley talks about here?
2
votes
1answer
629 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
2
votes
1answer
82 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
0
votes
3answers
4k views

Secure connection failed (OCSP)

I've been getting a lot of failed connections lately, namely from Facebook and now Google (German site works, French does not). This happened to other sites as well but these two are the kind you ...
3
votes
3answers
379 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
4
votes
2answers
2k views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
0
votes
1answer
105 views

From where I can get a list of trusted certificates fo HTTPS?

I am using OpenBSD with a browser named Xombrero that doesn't have SSL certs by default. Should I get the certs from the /etc/ssl/certs.pem file? (ex.: I am not trusting OCSP and don't trust that my ...
3
votes
1answer
115 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
2
votes
1answer
175 views

Multiple OCSP calls

We facing slowness issues with out Web start application when upgraded to the Java 7 update 25, (very slow to open the login screen). After our investigation we see that now Java security has enabled ...
2
votes
1answer
885 views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
0
votes
2answers
2k views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
14
votes
1answer
4k views

How does OCSP stapling work?

I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...