OCSP Cert Issues

Lucky Day

Lucky Day

Daywatch
Joined
October 19, 2006
Messages
5,215
Location
The Uncanny Valley
Joined
Oct 19, 2006
Messages
5,215
Location
The Uncanny Valley
I don't have that problem, using Firefox version 53.0.3. I checked the settings and OCSP stapling is enabled.
Are there specific https sites that don't work for you? Or are all https sites you've tried (like RPGWatch) not working for you?
 
Joined
Aug 30, 2006
Messages
11,223
Joined
Oct 19, 2006
Messages
5,215
Location
The Uncanny Valley
Is your system date set correctly? Wrong date will falsely invalidate certificates.
 
Joined
Nov 8, 2014
Messages
12,085
It definitely is. That comes up on the first google of this issue. This issue that is being reported just happened so it makes me think it may not be a coincidence.
 
Joined
Oct 19, 2006
Messages
5,215
Location
The Uncanny Valley
Hmm, there maybe something unusual going on with OCSP. It's an added security measure, but you're probably not taking too much of a risk to run without it for now.
 
Joined
Nov 8, 2014
Messages
12,085
Is it an added security measure? I thought it was only used to reduce the load on the requests to the registrar and thus speed up page loads. By using stapling the hosting site can 'staple' the certificate information to the request from the client, without the need for the client to contact the registrar on each request. This behavior could actually be seen as a security risk, which is resolved by limiting the time stamp of the certificate information that can be stapled, so that the encrypted registration information has to retrieved from the registrar by the host on a regular basis in order to make this work.
This functionality is embedded in Apache and nginx already, so could be easily enabled and disabled on sites (as long as they have the correct version of Apache/nginx). And clients can disable this and request the information directly from the registrar at the penalty of a (potentially) somewhat longer load time of a page.
 
Joined
Aug 30, 2006
Messages
11,223
IE doesn't work and Firefox has problems - this has nothing to do with RPGwatch.
Reinstall OS once again and don't mess the general registry. If for some reason you need to put OS data on another drive, change only default path for Users, don't change paths for program files and other stuff.
 
Joined
Apr 12, 2009
Messages
23,459
Lucky Day said:
TBH, I don't remember if it affected RPGWatch. Are you using OCSP?
Click to expand...
Just checked it and I remember now disabling it again after configuring it last year, for some reason I can't remember anymore.
 
Joined
Aug 30, 2006
Messages
11,223
Myrthos said:
Is it an added security measure? I thought it was only used to reduce the load on the requests to the registrar and thus speed up page loads. By using stapling the hosting site can 'staple' the certificate information to the request from the client, without the need for the client to contact the registrar on each request. This behavior could actually be seen as a security risk, which is resolved by limiting the time stamp of the certificate information that can be stapled, so that the encrypted registration information has to retrieved from the registrar by the host on a regular basis in order to make this work.
This functionality is embedded in Apache and nginx already, so could be easily enabled and disabled on sites (as long as they have the correct version of Apache/nginx). And clients can disable this and request the information directly from the registrar at the penalty of a (potentially) somewhat longer load time of a page.
Click to expand...

As I understand it, OCSP is an updated method of checking for invalid certificates. The OCSP stapling in particular is a way to reduce calls to the issuer, and also a way to mitigate some impostor attacks that OCSP is vulnerable to.
 
Joined
Nov 8, 2014
Messages
12,085
Oh now I understand you. I don't think he should disable OCSP though, but only the stapling.
 
Joined
Aug 30, 2006
Messages
11,223
I set security.ssl.enable_ocsp_stapling to false and that works for me. Is that stapling?

My laptop is fine without doing that, but I haven't checked my desktop yet.
 
Joined
Oct 19, 2006
Messages
5,215
Location
The Uncanny Valley
Yes that is the stapling setting. Disabling it doesn't make things less secure. A fraction slower perhaps (depending on the site you visit), but that is it.
 
Joined
Aug 30, 2006
Messages
11,223
In theory, it does make you a bit less secure. I wouldn't worry too much as a very short term fix, but ideally I wouldn't leave stapling disabled.
 
Joined
Nov 8, 2014
Messages
12,085
I don't think it becomes less secure, as now the issuer is always contacted to check if the certificate is revoked or not and the site you are visiting is not stapling this information to the browsers' request anymore. OCSP is still enabled, just stapling isn't.
 
Joined
Aug 30, 2006
Messages
11,223
Stapling the certificates does help against some security problems. Because of that, some sites actually mandate that the certs are stapled, so turning it off could actually cause problems on other sites.
 
Joined
Nov 8, 2014
Messages
12,085
You must log in or register to reply here.
Back
Top Bottom