Re:MacOS Catalina: Slow by Design?
by feross on Friday May 22, 2020 @05:54PM
(#23277511)
How about it's totally ineffective? OCSP is pointless if you "soft fail" when the OCSP server can't be reached. [1]
This is why Chrome disabled OSCP by default all the way back in 2012-2013 era. Not to mention the performance cost of making all HTTPS connections wait for an OCSP lookup. [2]
Re:MacOS Catalina: Slow by Design?
by johnp_ on Friday May 22, 2020 @06:34PM
(#23277843)
That's why there's OCSP stapling and OCSP must staple. Ever seen an nginx server fail HTTPS connection exactly once after rotating the certificate? That's nginx lazily fetching the OCSP response from upstream for stapling purposes.
This is why Chrome disabled OSCP by default all the way back in 2012-2013 era. Not to mention the performance cost of making all HTTPS connections wait for an OCSP lookup. [2]
[1]: https://www.imperialviolet.org/2012/02/05/crlsets.html
[2]: https://arstechnica.com/information-technology/2012/02/googl...