Talk:Online Certificate Status Protocol

message: Article says that Safari supports OCSP but it needs to be enabled in Keychain access. However, I have this disabled in Keychain Access but Safari is still querying OCSP servers. I suspect the settings in Keychain Access are ignored by Safari, and Safari has been using OCSP for some time. -- Ch'marr (talk) 00:34, 31 August 2011 (UTC)
thread_title:  Safari 

message: This piece of information would be very useful for people who are trying to gauge the merits of OCSP.  Are OCSP servers more trustworthy than certificate authorities?  If they are run by businesses, how do the businesses make money?
OCSP requests always go to the certificate authority that signed the certificate in question - those are the ones with the authority to revoke them
50.174.74.32 (talk) 22:54, 19 August 2014 (UTC)
thread_title:  Who runs the OCSP servers?  Is there more than one? 

message: It seems like contacting an OCSP server might have privacy risks.  First, it creates a record on-the-wire of every secure site a user connects to.  Not only can the OCSP server maintain this log, but eavesdroppers as well.  Additionally, the article mentions that it is typically an HTTP connection (not HTTPS).
Questions:
# Q: What solution eliminates the info leak to the CA?A: OCSP stapling with fallback to OCSP disabled.
# Q: Why is OCSP traffic typically HTTP and not HTTPS?  -- the response is signed by the CA so, in theory, you can't really forge them -- the protocol has been partially broken see: http://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatOCSP-PAPER2.pdfA: Perhaps to avoid infinite loops where it's necessary to check the revocation status of a cert in order to check the invocation status of the same cert. --Noiseiron (talk) 22:48, 9 May 2016 (UTC)
thread_title:  Are OCSP a privacy risk? 

message: Currently refernce no. 5 ( "No, Don't Enable Revocation Checking". 19 April 2014. Retrieved 24 April 2014. https://www.imperialviolet.org/2014/04/19/revchecking.html) seems to have unreliable information. It starts off by referring to the Heartbleed bug as the "Heartbeat" bug. This error is rather more significant than a typo and makes one wonder if they are very well informed about the topic at all. I believe it should be removed as well as any information that was used from the article. 66.225.134.125 (talk) 17:58, 23 December 2015 (UTC)
thread_title:  Not sure a reference is very reliable 

message: Maybe mention DOS attacks using OCSP: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6304  — Preceding unsigned comment added by FunnyDrink (talk • contribs) 13:49, 5 October 2016 (UTC)
thread_title:  DOS attacks 

message: Hello fellow Wikipedians,
I have just modified 2 external links on Online Certificate Status Protocol. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20100210031759/http://labs.opera.com/news/2006/11/09/ to http://labs.opera.com/news/2006/11/09/
*Added archive https://web.archive.org/web/20131203092421/http://www.processor.com/editorial/article.asp?article=articles%2Fp3113%2F48p13%2F48p13.asp to http://www.processor.com/editorial/article.asp?article=articles%2Fp3113%2F48p13%2F48p13.asp
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 11:15, 20 January 2018 (UTC)
thread_title:  External links modified (January 2018) 

message: This article (and the corresponding Certificate_revocation_list article) could be improved by consideration of non-browser scenarios; including enterprise and Internet-of-things. I am hoping for improvements that could guide decision making, and provide pointers for common methods of solving the issues. My first contribution is dealing with enterprise servers that don't have external internet connectivity, and therefore can't directly contact OCSP responders. Next up, improving the CRL vs. OCSP comparisons, including an explanation of the impact of different common scenarios (browser vs. IoT vs. enterprise). Also want to take into account implementation context for OCSP responders and CDP (CRL distribution point) implementations.  — Preceding unsigned comment added by Trsm.mckay (talk • contribs) 19:32, 10 October 2019 (UTC)
thread_title:  OCSP and non-browser scenarios