2

Let's assume that I have a server which accepts requests over HTTPS. The server resides in a closed environment, and relies on a local CA server. I am not sure if this is relevant, but the server is written in ASP.Net WebAPI.

What happens if the CA server goes down? Does that mean that the client will not be able to send responses over HTTPS? Does it mean the server will not understand them?

5

The CA is used for signing the certificate which then gets used inside the HTTPS connection. The CA is not involved in the validation of the trust chain of the certificate since this validation is done using the locally stored (and trusted) copy of the CA's certificate (root CA).

The CA will be involved when revocation checking is done using OCSP: If the OCSP responder does not work then the revocation check will temporarily fail. The failure handling depends on the browser, configuration and type of certificate. Usually browsers simply continue when OCSP checks cause temporary failures (i.e. unknown if certificate is rejected). The only exception is usually the revocation check for Extended Validation (EV) certificates, but browsers can often be configured to do strict OCSP checks in other cases too. Chrome is known for not doing OCSP checks but using some other source for revocation checks, but it might be that it will still use OCSP in case of private CAs.

Note that failure of the OCSP responder could be partly mitigated at the server side by periodically retrieving a new OCSP response from the responder and attaching it to the SSL handshake (OCSP stapling). In this case the browser does not need to ask the OCSP responder and thus will not have problems if the responder fails. Of course this can only be done for a limited time, because the stapled OCSP response has a limited lifetime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.