Do VPNs log and analyze OCSP requests?

Question

I am a privacy-conscious user currently living in Russia where the Internet is censored and monitored by the Russian state. Russian ISPs are legally required to log and store all users’ Internet traffic (even though in practice they seem to only log metadata if the traffic is encrypted with TLS, and many smaller ISPs violate the law by not maintaining logs at all) and provide it to law enforcement upon request. Russia blocks many popular VPNs, and Tor is only accessible through non-public bridges unknown to the Russian censorship authorities (they block the bridges they discover).

In this kind of an environment, it seems that using just about any VPN is better than using no VPN, even if the VPN in question is a “honey trap” controlled by the Chinese and logging users’ traffic in violation of its own privacy policy, as a recent leak has shown. Thus, in order to remain more private on my iPad, I further route much of my web traffic through the Onion Browser, using a User → VPN → Tor → Internet tunnel.

However, due to iPadOS limitations, the Onion Browser leaks information about the traffic through OCSP requests that are handled on the operating system level and are not routed through Tor, but only through the system-wide VPN I’m connected to. Given that an OCSP request contains the serial number of the website’s certificate which can be easily used to look up the domain (for example, at crt.sh), OCSP leaks somewhat defeat the purpose of using Tor in a situation where I don’t need to conceal my identity from the website I’m visiting, but want to hide my traffic from Russian ISPs, the Russian state, and a potentially nosy VPN.

So my question is the following:

How much of a privacy concern should be the fact that a VPN has access to my OCSP requests? Is there any information (official or leaked) about whether VPNs that log users’ traffic (openly or covertly) only log the traffic’s metadata or also its content? Has a logged OCSP request ever been used to unmask a user’s traffic?

P.S.: I can (and occasionally do) connect directly to Tor through a bridge that the Russian state seems not to know about, but am concerned that it increases the likelihood of the bridge being discovered and blocked (Russian ISPs are known to be using DPI), so I want to keep Tor bridges as a fallback option.

Answer 1

I don't know if there's any VPN providers that are intercepting OCSP requests, but yes the VPN providers can in theory intercept OCSP requests because OCSP requests are unencrypted. And if this can be a threat to your safety, then you should assume that they actively intercept and log them, even if they say they're not logging anything. If your safety is concerned, always assume that all VPN operators are liars that worked closely with Russian government, no matter how trustworthy they might seem. Only trust independently verifiable technical measures, and don't trust things that are just promises.

Realistically, whether this is something you need to be worried about depends on who's operating your VPN and where their servers are located. If you have a fairly trustworthy no-log VPN service that don't operate anything out of Russia, it is quite unlikely that they'll actually honour Russian warrants. But if you're using a VPN service that operates in Russia or have servers in Russia, then the Russian government would likely be able to force them to log your OCSP/internet traffic.

Note that OCSP leaks only leaks the website the you're visiting, but not the content of the traffic. If this is a concern to you, maybe you can see if you can just disable OCSP (not possible in iOS).

Also note that nowadays a lot of websites does OCSP stapling. If the website you're visiting staples, then your browser doesn't make OCSP requests. Consider if you can ask the operator of the website that you're visiting to set up OCSP stapling if they haven't already done so.