Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OCSP is brain-damaged and a privacy violation. Is there a way I can remove the specified OCSP responder from a certificate file to prevent my site's visitors from having to suffer it?

From what I understand, OCSP stapling would be great if it had browser support, though unfortunately I cannot use it at all in my current server configuration. :(

share|improve this question
OCSP can be great for enterprises running their own PKI infrastructure. But yes, it seems a bit silly for public certs from third party CAs. – Ryan Bolger Jul 27 '12 at 4:48
first: most (if not all) browsers don't request OCSP if the site does not have an Extended Validation certificate. Second: if you want to protect user's privacy, use ocsp stapling. Third: request for ocsp is harder to eavesdrop than the http request so for stuff like www OCSP privacy problems are rather overblown – Hubert Kario Feb 11 '14 at 22:37
up vote 4 down vote accepted

I don't believe so. Modifying the X.509 attributes in the public certificate would change the certificate's thumbprint hash, and invalidate the signature from the CA that issued the certificate.

share|improve this answer
I sort of suspected this but wanted a second opinion. Oh well. Thanks anyway. – Boann Jul 27 '12 at 17:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.