0

Our firm wants to validate certificates using OCSP in its branch offices. However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right thing to do imo.

So, because we want to centralize our CRLs, can we override the OCSP URL to use an internal OCSP responder which then locally checks against CRLs?

Is this technically feasible?

Kind regards, Ti.

  • it depends on OCSP server implementation. If OCSP server does support OCSP request forwarding (when OCSP does not have required information), then you can do this. Otherwise, it is not possible. – Crypt32 Nov 29 '16 at 17:08
1

Take a look at OCSP Stapling which was created to mitigate the problem of OCSP responder being down or unavailable.

the certificate holder (the web server) queries the OCSP server themselves at regular intervals, obtaining a signed time-stamped OCSP response. When the site's visitors attempt to connect to the site, this response is included ("stapled") with the TLS/SSL handshake via the Certificate Status Request extension response

All major browsers and web servers support OCSP stapling.

As far having the OCSP responder check the CRL list, this is technically possible but might lead to performance issues if your CRL list gets very large. Ideally you would want your CRL list to be stored in an indexed database of some sort which can be queried efficiently by your OCSP responder.

Instead of rolling your own OCSP responder, it would be better to use a proven existing responder which can check against a an indexed database that contains your CRL list entries.

  • OCSP stapling can't be used in our case as we would almost never authenticate / validate the same cert more than once. – Ti. Nov 30 '16 at 11:58
  • OCSP stapling will still work for the one time use and will still be more efficient as the client has to make only one network call. If you are only checking cert revocation once, are these all one time use certs? If so how many certs are you going to be handling? – ARau Nov 30 '16 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.