Re: OCSP Checking for certificates without AIA URLs

On Monday, October 17, 2016 at 2:57:18 PM UTC-4, Dan Bryan wrote:
> On Monday, October 17, 2016 at 2:02:27 PM UTC-4, Richard Barnes wrote:
> > Hey Dan,
> > 
> > There is nothing in Firefox to support this use case.  The live OCSP
> > checking code [1] (vs. stapled) pulls the OCSP responder URL from AIA at
> > validation time; there is no other way to configure a responder URL.
> > 
> > --Richard
> > 
> > [1]
> > http://searchfox.org/mozilla-central/source/security/certverifier/NSSCertDBTrustDomain.cpp#518
> > http://searchfox.org/mozilla-central/source/security/certverifier/NSSCertDBTrustDomain.cpp#565
> > 
> > On Mon, Oct 17, 2016 at 12:10 PM, Dan Bryan <[email protected]> wrote:
> > 
> > > Hello,
> > > In a PKI where there are multiple private CA's that do not publish
> > > revocation urls into the certificates AIA field, what options does Firefox
> > > provide for using a 3rd party revocation service who has been delegated as
> > > an OCSP authority for these CAs.
> > > I would like to be able to say Private CA1-3 should query responder
> > > http://ocsp1.com and Private CA4-5 should query http://ocsp2.com. This
> > > flexibility has been offered in CAPI via group policy certificate
> > > properties since vista. But being that firefox doesn't depend on CAPI for
> > > certificate validation, is there anyway to configure NSS to support
> > > something like this?
> > >
> > > Thanks,
> > >
> > > --Dan
> > > _______________________________________________
> > > dev-security mailing list
> > > [email protected]
> > > https://lists.mozilla.org/listinfo/dev-security
> > >
> 
> Thanks for the detailed info. I imagine it might be possible if a 3rd party Firefox "Security device" were loaded and developed to handle this use case, right? Or maybe an extension could be developed to make firefox think an AIA is present in a certificate?

Richard,

According to: http://kb.mozillazine.org/About:config_entries
it looks like there are/were several options:
security. OCSP. enabled = 2
security. OCSP. URL = http://myresponder

I attempted to configure these in about:config of firefox 47.0.1 and no requests went to my responder. This supports what your saying. I am guessing this was a feature that was enabled in the past, and is no longer present?