Hacker News new | ask | show | jobs
by charcircuit 1487 days ago
>OCSP is done over plain HTTP (for obvious reasons)

It's not obvious to me. Why can't it be done over HTTPS? From what I can tell nothing stops you from doing that.

2 comments

If OCSP was done over HTTPS, you'd end up with an infinite loop - you'd have to do an OCSP query to check that the OCSP server's certificate is not revoked, and so on.
Sure HTTPS wouldn't help if an attacker had the cert for the OCSP server, but I feel like that is rare to happen compared to other certs being revoked and I believe there are privacy / anticensorship benefits you ran get from https.

To me it seems simple to just skip an OSCP check compared to having to use HTTP.

i think because what is asked for is a list of revoked certs, and the connection being used could be already on that blacklist. the list must available without the involvement of what is being checked.
That's not what OCSP is. OCSP just lets you query the status of a cert.