2

Is the use of regular OCSP or OCSP stapling a privacy risk? Since a request is sent (in each handshake) to an (external) OCSP Responder.

The OCSP responder can potentially register a load of metadata.

Improve this question
3
  • There you have your answer. :)
    – Arminius
    Mar 16, 2017 at 21:25
  • @Arminius Sometimes it's so easy! :^). Why is this not concerning anyone? And did Google start the "fastest" OCSP responder already?
    – Bob Ortiz
    Mar 16, 2017 at 21:27
  • 1
    It is concerning some. That's why Google Chrome has regular OCSP disabled.
    – Arminius
    Mar 16, 2017 at 21:30

1 Answer 1

Reset to default
8

The usage of OCSP Stapling is actualy the solution to "hide" the visitors from CA's eyes. And of course also for reducing the load on CA's OCSP responders.

OCSP Stapling's principle is that the web server is getting the OCSP response from CA's OCSP responder on behalf of the visitor, so CA can't log the visitor's IP addres, time of the visit or anything else. The webserver then caches the response for some time and serves it to other visitors later (until the response expires). So the CA doesn't even know how many visits or visitors you have.

OCSP responses are signed by the CA so they can't be forged - thus using OCSP stapling is totaly safe.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .