Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

OCSP is brain-damaged and a privacy violation. Is there a way I can remove the specified OCSP responder from a certificate file to prevent my site's visitors from having to suffer it?

From what I understand, OCSP stapling would be great if it had browser support, though unfortunately I cannot use it at all in my current server configuration. :(

share|improve this question
    
OCSP can be great for enterprises running their own PKI infrastructure. But yes, it seems a bit silly for public certs from third party CAs. –  Ryan Bolger Jul 27 '12 at 4:48
    
first: most (if not all) browsers don't request OCSP if the site does not have an Extended Validation certificate. Second: if you want to protect user's privacy, use ocsp stapling. Third: request for ocsp is harder to eavesdrop than the http request so for stuff like www OCSP privacy problems are rather overblown –  Hubert Kario Feb 11 at 22:37
add comment

1 Answer

up vote 3 down vote accepted

I don't believe so. Modifying the X.509 attributes in the public certificate would change the certificate's thumbprint hash, and invalidate the signature from the CA that issued the certificate.

share|improve this answer
    
I sort of suspected this but wanted a second opinion. Oh well. Thanks anyway. –  Boann Jul 27 '12 at 17:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.