TLS Feature Extension ocsp must staple demonstration
Dan Bryan <[email protected]> Tue, 12 Jan 2016 08:46:00 -0800 (PST)
| Newsgroups | gmane.comp.mozilla.security |
|---|---|
| Message-ID | <[email protected]> |
Hello, I was reading the following article: https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/ Which states that: "OCSP Must-Staple makes use of the recently specified TLS Feature Extension. When a CA adds this extension to a certificate, it requires your browser to ensure a stapled OCSP response is present in the TLS handshake. If an OCSP response is not present, the connection will fail and Firefox will display a non-overridable error page. This feature will be included in Firefox 45, currently scheduled to be released in March 2016." I have downloaded firefox 45.0a2 (2016-01-12) and would like to see this in action. I own a certificate authority product that allows me to issue custom extensions, but I am unsure of what extension is called. Is their an OID or ASN1 value that indicates the CA should add the TLS Feature extension supporting ocsp must staple? --Dan