Enable OCSP stapling on the balancer #33

nateberkopec · 2015-10-16T14:44:10Z

Caveat: I'm not sure if outbound connections to the OCSPs are currently allowed or blocked by a firewall or something. I believe it can be checked by seeing if the following one-liner emits some OCSP urls:

OLDIFS=$IFS; IFS=':' certificates=$(openssl s_client -connect google.com:443 -showcerts -tlsextdebug -tls1 2>&1 </dev/null | sed -n '/-----BEGIN/,/-----END/ {/-----BEGIN/ s/^/:/; p}'); for certificate in ${certificates#:}; do echo $certificate | openssl x509 -noout -ocsp_uri; done; IFS=$OLDIFS

(one liner from here)

OCSP stapling should decrease SSL negotiation times by eliminating a roundtrip. For more about OCSP stapling: https://wiki.mozilla.org/Security/Server_Side_TLS#OCSP_Stapling We do not need to add an ssl_trusted_certificate line here because rubygems.org's certificate contains intermediate certs.

bai · 2015-10-20T07:57:24Z

Does our ssl_certificate include root cert? If not, we need to add ssl_trusted_certificate too.

nateberkopec · 2015-10-20T11:28:08Z

Oh yeah, you're right. That seems weird to me, since the client just uses its own root anyway, but everything I can find online says you're right.

nateberkopec closed this Apr 25, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable OCSP stapling on the balancer #33

Enable OCSP stapling on the balancer #33

nateberkopec commented Oct 16, 2015

bai commented Oct 20, 2015

nateberkopec commented Oct 20, 2015

Enable OCSP stapling on the balancer #33

Enable OCSP stapling on the balancer #33

Conversation

nateberkopec commented Oct 16, 2015

bai commented Oct 20, 2015

nateberkopec commented Oct 20, 2015