Hacker News new | ask | show | jobs
by darkhelmet 702 days ago
cough nginx. Nginx would start up and serve TLS on must-staple certs .. before doing the staple setup. ie: any client that validated that a must-staple cert had a stapled ocsp ticket would fail for the first few queries after nginx startup.

I don't know if they've fixed it yet. I doubt it though - they were pretty aggressive in their assertion that violating must-staple wasn't a concern.
3 comments
Nekit1234007 702 days ago
Well, this ticket is still open: https://trac.nginx.org/nginx/ticket/812
link
agwa 702 days ago
Yeah, I looked into nginx's stapling implementation almost a decade ago. I fixed some simpler bugs (I submitted a patch which was mostly rewritten and then merged) but fixing the problem you mention would have required major re-architecting. I doubt it has changed.
link
Avamander 699 days ago
Apache as well, though mod_md improves on it significantly.
link