Re: OCSP stapling problems

2014-03-14 Thread Hanno Böck
On Tue, 11 Mar 2014 11:01:26 -0700 Brian Smith br...@briansmith.org wrote: It would be great if you could test the new way of doing certificate/OCSP verification. To do so, please download Firefox 30 Nightly from http://nightly.mozilla.org/. After you install it, go to about:config and add a

Re: OCSP stapling problems

2014-03-14 Thread David Keeler
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 03/14/14 07:18, Hanno Böck wrote: However, I'd really like to stress again that I'd find it a very worrying signal if this issue will stay unfixed for three more major firefox versions to come. I'm pretty sure if at some point we want to get

OCSP stapling problems

2014-03-11 Thread Hanno Böck
Hello, I wanted to bring up an issue regarding OCSP stapling. I filled this bug shortly after Firefox 27 came out: https://bugzilla.mozilla.org/show_bug.cgi?id=972304 Short conclusion: If you have enabled OCSP stapling on your server this will break the possibility to add certificate exceptions

Re: OCSP stapling problems

2014-03-11 Thread Brian Smith
On Tue, Mar 11, 2014 at 3:20 AM, Hanno Böck ha...@hboeck.de wrote: I wanted to bring up an issue regarding OCSP stapling. I filled this bug shortly after Firefox 27 came out: https://bugzilla.mozilla.org/show_bug.cgi?id=972304 Short conclusion: If you have enabled OCSP stapling on your

Re: OCSP stapling problems

2014-03-11 Thread Hanno Böck
On Tue, 11 Mar 2014 11:01:26 -0700 Brian Smith br...@briansmith.org wrote: First, it is important to point out to others reading this that this problem only affects certificates that don't chain to a trusted root CA and/or which are considered invalid by Firefox for some other reason. AFAICT,