On Thu, May 03, 2012, Alexander Komyagin wrote: > Hi! In our project we want to perform a complete global switch to OCSP > certificate verification (for a number of reasons we don't want CRL's > anymore) to make openldap, openvpn and others use OCSP. >
You should note there is a side effect of doing this: it can't work properly with non-blocking I/O without application modification. The reason is that non-blocking I/O checks a single socket associated with the SSL/TLS connection while if you want to handle OCSP properly it would need to check a second completely different socket used by the OCSP connection. No existing application does that and no framework currently exists in OpenSSL to support this. As a result an unmodified application would block waiting for the OCSP response and if it would be unable to handle any other connections during this time. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
