Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: Natanael Mignon - michael-wessel.de <nm@michael-wessel.de>
To: "dev@httpd.apache.org" <dev@httpd.apache.org>
Date: Fri, 11 Sep 2009 13:31:04 +0200
Subject: AW: OCSP stapling in mod_ssl - use as OCSP cache for client
 authentication
Thread-Topic: OCSP stapling in mod_ssl - use as OCSP cache for client
 authentication
Thread-Index: AcoyxLURfBGdRXVhSe2cma+xkb3mGQADfTHg
Message-ID: 
 <E1EB39574EB96B45833BF0B6BE1137241E05C48787@vm-w2k3s04.intranet.michael-wessel.de>
References: 
 <E1EB39574EB96B45833BF0B6BE1137241E05C2AAEC@vm-w2k3s04.intranet.michael-wessel.de>
 <4AAA1C3B.9030803@oss-institute.org>
In-Reply-To: <4AAA1C3B.9030803@oss-institute.org>
Accept-Language: de-DE
Content-Language: de-DE
acceptlanguage: de-DE
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

> -----Urspr=FCngliche Nachricht-----
> Von: Dr Stephen Henson [mailto:shenson@oss-institute.org]
> Gesendet: Freitag, 11. September 2009 11:46
> An: dev@httpd.apache.org
> Betreff: Re: OCSP stapling in mod_ssl - use as OCSP cache for client
> authentication
>=20
=20
> Now to the actual query, if I understand it correctly. That patch works
> in
> reverse to your problem. It is designed to stop thousands of OCSP
> requests from
> SSL clients connecting to an Apache server and all simultaneously
> slamming an
> OCSP responder attempting to check the status of that server
> certificate.

[NM] Right, the patch basically works reverse to our way.

> What I think you are trying to do is to include a cache for OCSP
> queries the
> proxy itself makes which is IMHO the best solution. So instead of
> always
> consulting the OCSP responder it instead checks the cache to see if
> there is a
> valid OCSP response in there, if it is expired or invalid then and only
> then
> would it renew the response by making an actual query. Doing things
> that way
> doesn't need OCSP stapling support in the server(s).
>=20
> If that's correct then you could reuse some of the OCSP response query
> and
> caching code in the stapling patch. It implements similar
> functionality.

[NM] That's it, exactly. And I've come to the conclusion, too, that reusing=
 some of your code for our purpose would be the best solution. Hopefully, w=
e get it right. ;)

Mit freundlichen Gr=FC=DFen / Kind regards
 Natanael Mignon

IT-Dienstleistungen: beraten | planen | umsetzen | betreiben
__________________________________________________________________________=
=20

fon          (+49) 511 260 911-0 (DW: - 13)
fax          (+49) 511 318 039-9
eMail      nm@michael-wessel.de
web        www.michael-wessel.de

Bitte senden Sie wichtige E-Mails stets auch an service@michael-wessel.de, =
um sicherzustellen, dass diese zeitnah bearbeitet werden.