Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm testing my https page via webpagespeedtest on IE8, and in one run I noticed a bunch of OSCP requests sent to oscp.godaddy.com. I never noticed any such requests in previous runs.

When do browsers decide to send such requests? Does it have to do with the fact I moved hosting providers yesterday?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

IE relies on CryptoAPI for performing any certificate revocation/status checking task, so chances are:

  • an SSL certificate was presented to the browser
  • this was validated using the chain of CDPs listed by that certificate, and any CA CDPs (CRL Distribution Points - URLs from which CRLs are available) in the chain of certificates that were issued
  • a valid version of the CRL for a certificate in its issuance chain wasn't cached locally

And so CryptoAPI's chaining engine decided it needed newer information on whether one of those certificates had been revoked recently or not.

Any given operation on a certificate might cause CRL retrieval or OCSP-based checking; Windows will cache the CRL response for its validity period (or an OCSP response as specified by its max-age HTTP header), which might explain why you see it once in a while, but not regularly/frequently.

To "walk the chain" of CDPs yourself, open the certificate and go to the Certification Path tab - this shows the hierarchy of CAs which produced the certificate. Open each one, and look at its Details tab - the CRL location(s) at each level are what the client needs to check and cache in order to fully trust the certificate (the issuing Root must be trusted by your machine for anything in the chain to work); if OCSP is enabled, the AIA extensions are signficant as well.

Alternatively, save out the cert to a .CER file, and run the always-hilarious

CERTUTIL -verify -urlfetch mycert.cer 

command to see the chaining engine in action.

share|improve this answer
    
Hmm, interesting. I don't suppose there is a way to get a longer-lasting OCSP max age, is there? –  ripper234 Oct 27 '11 at 9:44
    
Also, what's a typical max age? –  ripper234 Oct 27 '11 at 9:46
    
max-age in the HTTP headers sense - it's defined by the OCSP responder (or the web server on which it runs). CRL lifetime is defined by the issuing CA - a day or two, or a week, are common timeframes, but as I say, it's up to the CA that publishes (and signs) the CRL how long it remains valid. From the client, you can't influence this behaviour. –  TristanK Oct 27 '11 at 9:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.