On 05/09/12 12:14, Maxim Dounin wrote:
Hello!
Here are patches for OCSP stapling support. Testing and
review appreciated.
<snip>
Known limitations:
- Unless externally set OCSP response is used (via the "ssl_stapling_file"
directive), stapled response won't be sent in a first connection. This
is due to the fact that OCSP responders are currently queried by nginx
once it receives connection with certificate_status extension in ClientHello,
and due to limitations in OpenSSL API (certificate status callback is
blocking).
Hi Maxim. This limitation is turning out to be a problem, for several
reasons:
1. In some situations, the limitation appears to be amplified - there
are more "first connections" than you might expect. Netcraft reported
[1] that:
"Fewer than 50% of the CloudFlare IP addresses responded with an OCSP
response stapled on the first non-discarded connection attempt. Even
after 20 requests, the response rate is not consistent, some IP
addresses still fail to staple an OCSP response on each and every SSL
connection. This inconsistent behaviour may be down to a number of
separate machines responding to the same IP address either in different
locations, or behind a load balancer."
2. The CA/Browser Forum are defining a "must staple" certificate
extension [2], which we anticipate that browsers (e.g. [3]) will
recognize and enforce, by aborting the TLS handshake if a stapled OCSP
response was not sent.
3. Google are planning [4] to require the use of Certificate
Transparency (CT) [5], and this plan expects OCSP Stapling to work reliably.
What work needs to be done to enable Nginx to send a stapled OCSP
response every time (without having to use the "ssl_stapling_file"
directive)?
Could you work around the fact that the OpenSSL certificate status
callback is blocking? Or would you absolutely require a non-blocking
alternative to be available?
(Ben Laurie, who is on both the OpenSSL and CT teams, told me recently:
"If there's changes needed to OpenSSL, it'd be helpful to know sooner
rather than later.")
Thanks.
[1]
http://news.netcraft.com/archives/2013/07/19/microsoft-achieves-world-domination-in-ocsp-stapling.html
[2] http://tools.ietf.org/html/draft-hallambaker-muststaple-00
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=901698
[4] http://www.ietf.org/mail-archive/web/tls/current/msg10083.html
[5] http://tools.ietf.org/html/rfc6962
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
