Is the use of regular OCSP or OCSP stapling a privacy risk? Since a request is sent (in each handshake) to an (external) OCSP Responder.
The OCSP responder can potentially register a load of metadata.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The usage of OCSP Stapling is actualy the solution to "hide" the visitors from CA's eyes. And of course also for reducing the load on CA's OCSP responders.
OCSP Stapling's principle is that the web server is getting the OCSP response from CA's OCSP responder on behalf of the visitor, so CA can't log the visitor's IP addres, time of the visit or anything else. The webserver then caches the response for some time and serves it to other visitors later (until the response expires). So the CA doesn't even know how many visits or visitors you have.
OCSP responses are signed by the CA so they can't be forged - thus using OCSP stapling is totaly safe.