2

We facing slowness issues with out Web start application when upgraded to the Java 7 update 25, (very slow to open the login screen).

After our investigation we see that now Java security has enabled the OCSP and CRL check for signed certificate and this is what is causing slowness as each jar download is making a trip to Certificate Authority for validation .

When we manually select on CRL method the response is much faster so in effect online verification with OCSP is adding the delay.

Using Wireshark we monitored the OCSP calls and observation is for out 18 jars download it is making close to 80 calls to CA. Does anybody know why we might be making so many calls when jars are much less than that?

2

Does any body know why we might be making so many calls when jars are much less than that?

I'd guess it might the result of two things:

  1. Each certificate in the chain needs to be checked against revocation
  2. Bad cache caching causing the same cert to be re-checked multiple times.
| improve this answer | |
  • Thanks for the response Stephane . What do you mean by Bad cache , is it on Java side on client pc or ... – user27872 Jul 3 '13 at 9:14
  • OCSP answers should be cached so your client don't query for the same certificate revocation status multiple times until the validity of the answer expires. I'm not familiar, unfortunately, with the way Java handles this. It's a client-side issue, however. – Stephane Jul 3 '13 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.