Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
From: Kaspar Brand <httpd-dev.2014@velox.ch>
Subject: Re: AW: [RFC] Enable OCSP Stapling by default in httpd trunk
To: dev@httpd.apache.org
References: 
 <CAKUrXK6k01WGqF8z6F3YBNbanbTaOSHbbzwSi2O3H3u03_mvUw@mail.gmail.com>
 <5454A244.6070006@velox.ch>
 <CAG5KPzypCfJ7rZVBSC6t2hqxV5=zJcBDRcQxrGVUmnuYAsU_mw@mail.gmail.com>
 <AB1691BE05AE7F4992697F2A0835627AC62BA27A@VOEXM10W.internal.vodafone.com>
 <CACsi253AWvm1OU9BYfpQ-6EJuW=gcvv4piiQqAw=MR7VYye=tg@mail.gmail.com>
 <55957CF1.2050302@apache.org> <55965D5A.3040706@comodo.com>
 <AB1691BE05AE7F4992697F2A0835627AC62BD101@VOEXM10W.internal.vodafone.com>
 <55E1D63F.2040808@gmx.de>
Message-ID: <55E2A489.6000403@velox.ch>
Date: Sun, 30 Aug 2015 08:36:57 +0200
MIME-Version: 1.0
In-Reply-To: <55E1D63F.2040808@gmx.de>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

On 29.08.2015 17:56, olli hauer wrote:
> On 2015-07-03 12:13, Plüm, Rüdiger, Vodafone Group wrote:
>> Thanks for the detailed explanation. So yes OCSP stapling is really
>> beneficial if it is possible for the server admin to set it up. But
>> it likely requires additional configuration steps outside of httpd
>> to make the OCSP responder reachable (like firewall clearances) and
>> leads to otherwise strange "slow" responses if this is not
>> prepared. Another obstacle with the current stapling code is that
>> the connection to the OCSP responder of the CA needs to happen
>> directly and cannot be done via a proxy. Hence I agree with Kaspar
>> that it should be off by default.
>> 
> 
> Not tested, but looking at the mod_ssl doc it seems
> SSLStaplingForceURL can be used to proxy requests to the OCSP
> responder(s)
> 
> http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslstaplingforceurl
>
> In case SSLStaplingForceURL can be used to force OCSP requests via
> proxy it would be nice to add something like the following patch
> before enabling OCSP stapling as default.

It can't be used like this, as pointed out in [1]. Its main use is for
certs which do not include an OCSP URI at all, so configuring
SSLStaplingForceURL at the global level doesn't make much sense - you
would have to run a "transparent OCSP proxy" at that URL (mod_ssl will
just send plain OCSP requests to this address).

Kaspar

[1] https://mail-archives.apache.org/mod_mbox/httpd-dev/201411.mbox/%3C5454A1FE.6060204%40velox.ch%3E