Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ocsp]

Online Certificate Status Protocol (OCSP) is a protocol used for validation (ie revocation status) of X509 certificates in a PKI system as a real-time alternative to CRLs.

3
votes
2answers
65 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
1
vote
1answer
64 views

OCSP responseStatus, is it really useful?

Based on RFC-6960 an OCSP Response should have the following as a minimum: OCSPResponse ::= SEQUENCE { responseStatus OCSPResponseStatus, responseBytes [0] EXPLICIT ResponseBytes ...
0
votes
1answer
110 views

PKI - CRL and OCSP

I've done quite a bit of reading about PKI in ADCS and CRL/OCSP, but I can't seem to find an answer to a small couple of questions I still have: It is clear to me that even with OCSP in place, you ...
1
vote
1answer
40 views

How can a client validate a OCSP Responders Delegate Certificate and how does it obtain it?

In RFC 6960 4.2.2.3. Basic Response the response components are defined. This list does not contain the OCSP Responders certificate. If the responder is a delegate, the requester does not have a copy ...
1
vote
1answer
110 views

OCSP, CRLs, crlset - Revocation Delivery and Attacks

OCSP responses have a 'nextUpdate' field, which is the expected time for the new revocation update and that the current revocation can be considered valid. The revocations can be cached by the ...
9
votes
1answer
243 views

Do long lived TLS connections pose a security risk?

I would like to better understand the implications of maintaining a long lived (hours, days) TLS connection with respect to certificate revocation. As I understand TLS, the client verifies the server'...
2
votes
1answer
116 views

Does the ECDSA signature value (of an OCSP response) need to be DER encoded

In OCSP responses by a certain eIDAS PKI I every once in a while get signature values which, when unpacked from their BIT STRING, contain an ECDSA signature whose INTEGER constituents have an ...
1
vote
0answers
29 views

RFC6960 requested ocsp service definition

In RFC6960 (https://tools.ietf.org/html/rfc6960) is written the request data contains the requested service and the OCSP responder checks, if the requested service is provided. But when I had a look ...
0
votes
1answer
1k views

How can I figure out which OCSP URL should be used for a certificate with OpenSSL?

I have a PEM file that encodes a site's leaf certificate. I'd like to check it hasn't been revoked by querying the relevant OCSP server but I don't know which URL to use. How can I extract the OCSP ...
4
votes
2answers
487 views

Should webservers staple unsuccessful OCSP responses?

My primitive understanding of OCSP is that: Assertions are signed by the CA and valid for a short period. Stapling refers to the practice of pushing the OCSP request work onto the webserver, and then ...
0
votes
1answer
130 views

What's the common strategy for issuing OCSP requests

I am currently defining a PKI for code signing certificates on an embedded device (without internet connection). I define the behavior of the certificate issuer(FW release authority) as well as the FW ...
0
votes
1answer
256 views

OCSP doubts about CA and OCSP Responder

My question is about this image. Suppose that client is Alice and Server is Bob. So, basically, I'm trying to setup a scenario... I have a remote Server (Bob) that has an https website. I make: ...
0
votes
1answer
167 views

OCSP stapling Alice and Bob

In the case of OCSP stapling in the browsers, it works this way. But my question is, in a case where I have a communication between Alice and Bob how this works? I know that if I use OCSP normal, both ...
1
vote
0answers
197 views

Cisco ASA, OCSP

I have successfully configured OpenSSL OCSP responder with this hierarchy: RootCA > OCSP responder (signed by RootCA). I have deployed a trustpoint (named RootCA) into the ASA with the RootCA public ...
3
votes
2answers
2k views

Can't request ocsp status with chain of certificates

I have deployed basic ocsp server from OpenSSl Cookbook by Ivan Ristic page 44 with following command $ openssl ocsp -port 9080 -index db/index -rsigner root-ocsp.crt -rkey private/root-ocsp.key -CA ...
1
vote
1answer
332 views

Is the use of regular OCSP or OCSP stapling a privacy risk?

Is the use of regular OCSP or OCSP stapling a privacy risk? Since a request is sent (in each handshake) to an (external) OCSP Responder. The OCSP responder can potentially register a load of ...
6
votes
2answers
1k views

What is the exact difference between regular OCSP and OCSP stapling?

What is the exact difference between the Online Certificate Status Protocol (OCSP) and OCSP stapling, which seems to be "...an alternative approach to the Online Certificate Status Protocol (OCSP)"?
1
vote
1answer
499 views

Can an OCSP response be issued by a subca of the Root CA that has issued the certificate?

Is this Public Key Infraestructure possible according with the RFC 6960 Online Certificate Status Protocol - OCSP, Authorized Responders? OCSP response for Cert is signed with a certificate issued by ...
1
vote
0answers
108 views

Combining OCSP Stapling and manual OCSP request from client [closed]

Currently, I have an implementation where I send an OCSP request in the verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx) function for every intermediate and end-entity certificate. The ...
3
votes
1answer
231 views

OCSP Responder certificate - CRL distribution points and AIA OCSP URI

I am building OCSP responder and I need to issue OCSP Signer certificate from CA that will be used to sign OCSP responses. In a definition of certificate profile for OCSP Signer certificate, should I ...
0
votes
1answer
93 views

OCSP from branch office to central office

Our firm wants to validate certificates using OCSP in its branch offices. However, when the OCSP responder as defined in the certificate is down, they want to fallback on CRLs, which is the right ...
2
votes
0answers
62 views

Is there an imbalance of issuer and responders in OCSP verification?

I'm trying out OCSP verification, and I'm not sure I'm following all that's going on. The requester can send 1-N certificate IDs, each has issuer hashes/serial no. The responder generates the counter-...
1
vote
1answer
273 views

Revocation of intermediate trusted CA

My question is related to the revocation of intermediate CA. Suppose I have a device that performs the revocation checks on the whole chain and assigns the intermediate CA's a trusted level.Now ...
4
votes
1answer
2k views

Does Firefox use OCSP?

And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
2
votes
1answer
314 views

OCSP recording with JMeter

How can I record an application which is using OCSP security with the help of JMeter? I am not able to record the application i.e. a native app with the help of JMeter as it is using OCSP protocol ...
2
votes
1answer
2k views

OpenSSL certificate revocation check in client program using OCSP stapling 2

Pretty much this is request for additional information for the question: https://stackoverflow.com/questions/9607516/openssl-certificate-revocation-check-in-client-program-using-ocsp-stapling I want ...
6
votes
1answer
2k views

How to simply check if a certificate has the OCSP must-staple attribute?

http://tools.ietf.org/html/rfc7633 https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/ How can I simple check if a certificate of a ...
28
votes
3answers
2k views

Does any technology prevent a CA unilaterally revoking a certificate?

As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP). In an increasingly TLS world, what current technology stops a CA shutting ...
0
votes
1answer
584 views

OCSP stapling details and doubts

I am trying to figure out the details of OCSP stapling and how it works. As often the best way is, I started Wireshark and made a simple request to a server that has OCSP stapling enabled. Can anyone ...
2
votes
1answer
46 views

Questions regarding CRLs (producedAt and not modified)

I have two questions regarding the safety of requesting CRLs. My first question is: shouldn't CRLs contain a producedAt field just like OCSP responses? This would make sure a hacker doesn't send an ...
3
votes
1answer
314 views

OCSP responder servers and malicious site blocking

So I've been looking for an answer to this one but no one seemed to have asked this before. As far as I understand, when connecting to a website. The browser sends a query to an OCSP server to verify ...
3
votes
2answers
312 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
11
votes
1answer
297 views

Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?

I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate. I recently answered another question and ended up drafting a timeline. That timeline is basically this: Jul 5 00:...
2
votes
1answer
602 views

Can I modify my certificate chain?

I've had SSL/TLS running on my site now for a while. In order to learn a bit more about general PKI, I studied Qualys' SSL test, and optimised my configuration (including the adoption of OCSP stapling)...
2
votes
0answers
214 views

OCSP responder penetration testing

I have to do penetration testing on an OCSP responder. Are there any frameworks for OCSP pentesting? since it does not include any web applications to test, should I only run network penetration tests ...
18
votes
2answers
27k views

SSL/TLS: How to fix “Chain issues: Contains anchor”

I just ran a quick test at ssllabs.com: got A+, which I'm happy about. However there's one thing I don't know how to "fix": My site supports OCSP stapling and ssllabs keeps telling me: Chain issues: ...
3
votes
3answers
7k views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
12
votes
2answers
5k views

What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)

I just bought a certificate from RapidSSL. Looking up the chain, I found GeoTrust who is signed by Equifax. Then I realized that the ”Equifax Secure Certificate Authority” is due to expire on 2018-08-...
-2
votes
1answer
115 views

Can OCSP stapling reduce or eliminate the weaknesses inherrent with OCSP? [closed]

Specifically, the problems with OCSP that Adam Langley talks about here?
2
votes
1answer
1k views

“global” OCSP with Apache mod_ssl / Alternative to -VAfile option Openssl

Context I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want ...
2
votes
1answer
142 views

How does checking CRLs make sites less safe?

With the frantic certificate upheaval resulting from the Heartbleed fiasco [drink!], there has been lots of talk regarding certificate revocation, and in particular the policy of certificate ...
2
votes
4answers
8k views

Secure connection failed (OCSP)

I've been getting a lot of failed connections lately, namely from Facebook and now Google (German site works, French does not). This happened to other sites as well but these two are the kind you ...
4
votes
3answers
2k views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
5
votes
2answers
4k views

How to configure Browser to detect revoked certificates?

In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that ...
0
votes
1answer
490 views

From where I can get a list of trusted certificates fo HTTPS?

I am using OpenBSD with a browser named Xombrero that doesn't have SSL certs by default. Should I get the certs from the /etc/ssl/certs.pem file? (ex.: I am not trusting OCSP and don't trust that my ...
3
votes
1answer
160 views

In theory, can x509 certificates use Accumulator-based revocation schemes? How do these schemes work?

On page 3 of this U-Prove document regarding toke revocation, the author says the benefit of Accumulator-based revocation schemes is A cryptographic accumulator allows the aggregation of a large ...
2
votes
1answer
257 views

Multiple OCSP calls

We facing slowness issues with out Web start application when upgraded to the Java 7 update 25, (very slow to open the login screen). After our investigation we see that now Java security has enabled ...
2
votes
1answer
1k views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
1
vote
2answers
3k views

How to test for OCSP?

I have to test OCSP feature on a SSL server. Since it is a pretty standard feature now, I was looking around for tips on test plans/setting up OCSP responder etc?
30
votes
1answer
10k views

How does OCSP stapling work?

I've been looking into OCSP stapling for HTTPS, which looks pretty interesting. From what I can tell, it's essentially a way of offloading CRLs from the CA to the server, allowing for everything to be ...