Mailing-List: contact bugs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache HTTPD Bugs Notification List" <bugs@httpd.apache.org>
Date: Wed, 9 Feb 2011 04:13:11 -0500 (EST)
From: bugzilla@apache.org
To: bugs@httpd.apache.org
Subject: DO NOT REPLY [Bug 50740] New: Enable OCSP Stapling by default
Message-ID: <bug-50740-7868@https.issues.apache.org/bugzilla/>
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0

https://issues.apache.org/bugzilla/show_bug.cgi?id=50740

           Summary: Enable OCSP Stapling by default
           Product: Apache httpd-2
           Version: 2.3-HEAD
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: mod_ssl
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: rob@comodo.com


Currently, OCSP Stapling is disabled by default.  To enable it, the
"SSLUseStapling On" directive must be added to the config, along with another
directive that enables an OCSP Stapling Cache.

OCSP Stapling benefits pretty much everyone:
  - End-users: Improved privacy and faster SSL/TLS handshakes, because the
client software does not need to contact a third-party OCSP Responder to get
the current status of the end-entity certificate.
  - CAs: Decreased load, bandwidth requirements and cost for operating an OCSP
Responder infrastructure.
  - Websites: No direct benefits, but they often care about their end-users'
interests.

My concern is that many webmasters will not add the necessary config directives
to enable OCSP Stapling, even though there is no downside to enabling it.  I
imagine that many webmasters have probably never even heard of OCSP Stapling!

Therefore, I propose that mod_ssl should enable OCSP Stapling by default,
without any config directives needing to be specified.  (Aside: this would
match the behaviour of IIS 7.x on Windows Vista/2008 Server and newer).

The OCSP Stapling Cache would need to be created automatically with some
sensible default values.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org