1
$\begingroup$

There are two ways of checking the status of a digital certificate:-

  1. Offline Authentication (CRL)
  2. Online Authentication (OCSP, SCVP)

Several browsers (like Mozilla Firefox) have given up the use of CRL over OCSP.

OCSP and SCVP are susceptible to MITM attacks.

Then which method is used a primary means of checking the status of a digital certificate?

$\endgroup$
3
$\begingroup$

OCSP is not susceptible per se to MITM attacks, but it does have other problems:

  • Most browsers used to soft-fail, e.g., if they couldn't get the OCSP response for some reason, it allowed the connection to go through. So the attacker only needed to block the OCSP response.
  • Privacy issues: an attacker can see the OCSP query going through and can gain some information about your browsing.

This is solved by OCSP stapling, where the server is responsible for getting the OCSP response and sending it to the client (stapling). There is also the must-staple extension that makes stapling mandatory, otherwise a MITM attacker that stole the server private key could just not staple the OCSP response.

$\endgroup$
  • $\begingroup$ I was reading about OCSP Stapling, and it states a time-stamped OCSP response signed by the CA. Which CA is being referred here? CA of the certificate holder? And if yes, Then how does the signing happens? $\endgroup$ – Vasu Deo.S Aug 7 at 8:16
  • 1
    $\begingroup$ @VasuDeo.S the CA that emitted the server certificate. The CA maitains a OCSP service which is queried by the client (regular OCSP) or server (OCSP stapling), the responses are signed by the CA private key so that they can be verified with the CA certificate. $\endgroup$ – Conrado Aug 7 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.