Is the use of regular OCSP or OCSP stapling a privacy risk? Since a request is sent (in each handshake) to an (external) OCSP Responder.

The OCSP responder can potentially register a load of metadata.

  • There you have your answer. :) – Arminius Mar 16 '17 at 21:25
  • @Arminius Sometimes it's so easy! :^). Why is this not concerning anyone? And did Google start the "fastest" OCSP responder already? – Bob Ortiz Mar 16 '17 at 21:27
  • 1
    It is concerning some. That's why Google Chrome has regular OCSP disabled. – Arminius Mar 16 '17 at 21:30

The usage of OCSP Stapling is actualy the solution to "hide" the visitors from CA's eyes. And of course also for reducing the load on CA's OCSP responders.

OCSP Stapling's principle is that the web server is getting the OCSP response from CA's OCSP responder on behalf of the visitor, so CA can't log the visitor's IP addres, time of the visit or anything else. The webserver then caches the response for some time and serves it to other visitors later (until the response expires). So the CA doesn't even know how many visits or visitors you have.

OCSP responses are signed by the CA so they can't be forged - thus using OCSP stapling is totaly safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.