Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of the certificate.

What mitigations are there to prevent OCSP replay attacks on a client that doesn't support NONCES?

More info:

From what I can tell all software that relies on the verification process in CryptoAPI works this way. I believe this includes:

  • IE (SSL and client certs)
  • .NET network bindings (WCF, HTTPS, WebClient)
  • Smart Cards
  • among many others...

2 Answers 2


Rook, Chrome on Windows uses CryptoAPI on other platforms they use NSS but NSS's revocation platform isn't "Faster" and doesnt send nonces (by default) either - its actually the least performant and robust revocation implementation of all the browsers.

There are a bunch of pending improvements to the NSS revocation behavior that should fix this in the near future.

We offer OCSP services for our products, one of the larger pool of responders on the internet; the number of requests we get with nonces approaches 0 (almost none).

makerofthings - Java applications will each behave differently, its possible to get Java to send nonces, sign requests, etc; its all up to the application.

As for the original request, there is limited protection to replays based on time (see security considerations in - http://www.ietf.org/rfc/rfc5019.txt). Supporting nonces also requires dynamically signing OCSP responses, Symantec issues 3 billion OCSP responses a day under normal load and this is with cached responses. Introducing dynamic signing would both be several orders of magnitude more expensive to operate (especially globally) but also expose them to a trivial resource consumption DOS.

Nonces make the most sense in the enterprise where signed requests also have a chance of working, if you want to use them you should look at installing a revocation provider in windows like the Axway desktop validator.


  • Hello Ryan, welcome to Security.SE. By "our products" do you mean Microsoft? Commented Jun 11, 2012 at 16:01
  • Sorry, I am the CTO of GlobalSign. In a past life I worked at Microsoft on this area.
    – user10546
    Commented Jun 11, 2012 at 20:50

Chrome and Firefox have their own OCSP implementations. Firefox has this enabled by default, where as chrome has their own CRL system which is much faster and isn't subject to a replay attack. You can enable Chrome's OCSP support in the configuration menu.

  • That is a good workaround for many Browser Based apps. All that leaves is anything that relies on CryptoAPI (.NET client/server apps, WCF) Not sure how Java bahaves Commented Jun 8, 2012 at 1:29
  • Any links or information about how Firefox or Chrome does its revocation in depth would be good. I don't want to end up downgrading my security for the particular scenarios I care about, which may or may not include popular sites that Google monitors. Commented Jun 8, 2012 at 1:42
  • @makerofthings7 dude i'm not going to write your blog for you.
    – rook
    Commented Jun 8, 2012 at 2:46
  • For what it's worth, I don't have a blog (otherwise I'd link to it on my profile here). I just spend my time on StackExchange and a few other spots. Commented Jun 8, 2012 at 3:28
  • 1
    Please try to stay constructive. I don't see anything unreasonable in makerofthings7's query that would merit aggressive remarks. Thank you!
    – D.W.
    Commented Jun 8, 2012 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .