Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add OCSP stapling #42

Closed
jsolly opened this issue May 4, 2022 · 1 comment
Closed

Add OCSP stapling #42

jsolly opened this issue May 4, 2022 · 1 comment
Labels
Non-Functional Enhancement Anything that isn't a feature (performance, refactoring, etc) security

Comments

@jsolly
Copy link
Owner

jsolly commented May 4, 2022

Context

According to the Godaddy cert checker, my site doesn't implement this. According to digicert

OCSP stapling can be used to enhance the OCSP protocol by letting the webhosting site be more proactive in improving the client (browsing) experience. OCSP stapling allows the certificate presenter (i.e. web server) to query the OCSP responder directly and then cache the response. This securely cached response is then delivered with the TLS/SSL handshake via the Certificate Status Request extension response, ensuring that the browser gets the same response performance for the certificate status as it does for the website content.

Things to consider

Digicert has a guide on how to do this in Apache
https://www.digicert.com/kb/ssl-support/apache-enable-ocsp-stapling-on-server.htm

There is also this cool tool put out by Mozilla that appears to add OCSP stapling to an apache config boilerplate
https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1k&guideline=5.6

@jsolly jsolly added enhancement Non-Functional Enhancement Anything that isn't a feature (performance, refactoring, etc) security and removed enhancement labels May 4, 2022
@jsolly
Copy link
Owner Author

jsolly commented May 26, 2022

Tried following the guides and no luck. I don't think I am enough of an Apache Wizard to figure this one out. I will most likely be moving to a new web server anyway, so I would rather not burn more time trying to figure this one out.

Closing for now!

@jsolly jsolly closed this as completed May 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Non-Functional Enhancement Anything that isn't a feature (performance, refactoring, etc) security
Projects
None yet
Development

No branches or pull requests

1 participant