In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that browser either only soft-fail or don't check the CRL at all because soft-fail is useless. Firefox lets one make OCSP response mandatory but it has significant disadvantages. What are the recommended settings / plugins to use to detect certificates which have been revoked since Heartbleed was announced? Specifically I would like to
- Make OCSP mandatory for certificates issued before 04/07. Maybe with a fallback to something like Perspectives. Does any such extension exist / is under development?
- Have the CRL record of a certificate cached from my previous visit to a site. That doesn't help against MTM attack on my first visit but I would notice a MITM with a revoked certificate on any subsequent visit.
Any other recommendations of extensions settings to solve this problem? I'm happy to change the browser to solve the issue, thus recommendation for any browser are welcome.