Thanks for the note, Stephen! I'll certainly take this into account. If I incorporate OCSP check in check_revoked() function, which is called during SSL connect/handshake it would just block during connect op for a while, and I believe that no single service shall expect connection establishment to be fast. Good service will handle other connections in a separate thread for the sake of availability, won't it?
On Thu, 2012-05-03 at 13:11 +0200, Dr. Stephen Henson wrote: > On Thu, May 03, 2012, Alexander Komyagin wrote: > > > Hi! In our project we want to perform a complete global switch to OCSP > > certificate verification (for a number of reasons we don't want CRL's > > anymore) to make openldap, openvpn and others use OCSP. > > > > You should note there is a side effect of doing this: it can't work properly > with non-blocking I/O without application modification. > > The reason is that non-blocking I/O checks a single socket associated with the > SSL/TLS connection while if you want to handle OCSP properly it would need to > check a second completely different socket used by the OCSP connection. No > existing application does that and no framework currently exists in OpenSSL > to > support this. > > As a result an unmodified application would block waiting for the OCSP > response and if it would be unable to handle any other connections during this > time. > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > Development Mailing List [email protected] > Automated List Manager [email protected] -- Best wishes, Alexander Komyagin ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
