Re: TLS Feature Extension ocsp must staple demonstration

Hubert Kario <[email protected]> Tue, 02 Feb 2016 12:39:59 +0100

Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>

On Monday 01 February 2016 07:47:44 Dan Bryan wrote:
> Thanks for the info, I was successfully able to create a certificate
> with status_request assertion built in.  My understanding is that
> mozilla will support both enforcement of the status_request assertion
> in the X509 certificate, as well as must staple assertion in HTTP
> response. Are you able to provide any references on how to configure
> a web server (IIS or apache) to provide this? I don't even see a
> mention of staple on the list of http headers
> https://en.wikipedia.org/wiki/List_of_HTTP_header_fields

OCSP Stapling is implemented on lower level, not as a HTTP header but as 
a TLS extension, see Certificate Status Request[1].

Feature you're looking for are enabled by SSLUseStapling directive in 
mod_ssl[2] and NSSOCSP in mod_nss[3].

 1 - https://tools.ietf.org/html/rfc6066#section-8
 2 - https://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslusestapling
 3 - 
https://git.fedorahosted.org/cgit/mod_nss.git/plain/docs/mod_nss.html
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

signature.asc (application/pgp-signature, 819 B)