Online Certificate Status Protocol (OCSP) is a protocol used for validation (ie revocation status) of X509 certificates in a PKI system as a real-time alternative to CRLs.

learn more… | top users | synonyms

1
vote
1answer
38 views

OpenSSL certificate revocation check in client program using OCSP stapling 2

Pretty much this is request for additional information for the question: http://stackoverflow.com/questions/9607516/openssl-certificate-revocation-check-in-client-program-using-ocsp-stapling I want ...
3
votes
1answer
94 views

How to simply check if a certificate has the OCSP must-staple attribute?

http://tools.ietf.org/html/rfc7633 https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/ How can I simple check if a certificate of a ...
28
votes
3answers
2k views

Does any technology prevent a CA unilaterally revoking a certificate?

As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP). In an increasingly TLS world, what current technology stops a CA shutting ...
0
votes
1answer
89 views

OCSP stapling details and doubts

I am trying to figure out the details of OCSP stapling and how it works. As often the best way is, I started Wireshark and made a simple request to a server that has OCSP stapling enabled. Can anyone ...
3
votes
1answer
34 views

Questions regarding CRLs (producedAt and not modified)

I have two questions regarding the safety of requesting CRLs. My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
3
votes
1answer
52 views

OCSP responder servers and malicious site blocking

So I've been looking for an answer to this one but no one seemed to have asked this before. As far as I understand, when connecting to a website. The browser sends a query to an OCSP server to verify ...
3
votes
2answers
118 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
10
votes
1answer
225 views

Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?

I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate. I recently answered another question and ended up drafting a timeline. That timeline is basically this: Jul 5 ...
2
votes
1answer
149 views

Can I modify my certificate chain?

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP ...
2
votes
0answers
104 views

OCSP responder penetration testing

I have to do penetration testing on an OCSP responder. Are there any frameworks for OCSP pentesting? since it does not include any web applications to test, should I only run network penetration tests ...
8
votes
2answers
9k views

SSL/TLS: How to fix “Chain issues: Contains anchor”

I just ran a quick test at ssllabs.com: got A+, which I'm happy about. However there's one thing I don't know how to "fix": My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: ...
2
votes
3answers
4k views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
8
votes
2answers
1k views

What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)

I just bought a certificate from RapidSSL. Looking up the chain, I found GeoTrust who is signed by Equifax. Then I realized that the ”Equifax Secure Certificate Authority” is due to expire on ...
-2
votes
1answer
74 views

Can OCSP stapling reduce or eliminate the weaknesses inherrent with OCSP? [closed]

Specifically, the problems with OCSP that Adam Langley talks about here?
2
votes
1answer
949 views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
2
votes
1answer
116 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
2
votes
4answers
6k views

Secure connection failed (OCSP)

I've been getting a lot of failed connections lately, namely from Facebook and now Google (German site works, French does not). This happened to other sites as well but these two are the kind you ...
4
votes
3answers
619 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
4
votes
2answers
3k views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
0
votes
1answer
209 views

From where I can get a list of trusted certificates fo HTTPS?

I am using OpenBSD with a browser named Xombrero that doesn't have SSL certs by default. Should I get the certs from the /etc/ssl/certs.pem file? (ex.: I am not trusting OCSP and don't trust that my ...
3
votes
1answer
125 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
2
votes
1answer
209 views

Multiple OCSP calls

We facing slowness issues with out Web start application when upgraded to the Java 7 update 25, (very slow to open the login screen). After our investigation we see that now Java security has enabled ...
2
votes
1answer
1k views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
1
vote
2answers
2k views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
14
votes
1answer
6k views

How does OCSP stapling work?

I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...