News for hackers. Stuff that matters.
Re:Let's Encrypt is down by jfindley on Friday May 19, 2017 @10:43AM (#14376083)
This is exactly the problem with OCSP. There's no way to tell if the remote server is down, or if a malicious actor sitting in your path is blocking it. So your browser can either a) make it super easy for all your OCSP-using sites to appear down, which will encourage users to use other, non-OCSP, sites, or b) silently fail, which makes the entire exercise pointless.

Stapling only partially mitigates this, as it doesn't currently work with intermediate certs, and at this point most sites have at least one intermediate cert.

Re:Let's Encrypt is down by pas on Friday May 19, 2017 @11:02AM (#14376324)
Could you elaborate on why they don't work with intermediate certs?
Re:Let's Encrypt is down by jfindley on Friday May 19, 2017 @11:11AM (#14376439)
RFC 6066 specifies that you can only have one certificate in an OCSP response - as with intermediate certs you need to be able to respond with a chain, this does not work. RFC 6961 defines a multiple response capability, but my understanding is that currently this is not sufficiently widely implemented to be useful yet.
Re:Let's Encrypt is down by pas on Friday May 19, 2017 @11:54AM (#14376876)
Thanks! I thought it's enough if the stapled response contains information only about the intermediate cert, and the browser would accept that as good enough, if the chain it got in the handshake is valid.

https://bugzilla.mozilla.org/show_bug.cgi?id=611836 - this looks pretty abandoned (last comment 3 years ago) :/

and I found no bug for Chrome.

Re:Let's Encrypt is down by skrubly on Friday May 19, 2017 @02:39PM (#14378281)
Chrome, as far as I know, does not do OCSP - https://www.imperialviolet.org/2012/02/05/crlsets.html