Re: OCSP Checking for certificates without AIA URLs

On 10/17/16 1:26 PM, Dan Bryan wrote:
> According to: http://kb.mozillazine.org/About:config_entries
> it looks like there are/were several options:
> security. OCSP. enabled = 2
> security. OCSP. URL = http://myresponder

That never worked very well. When you turned that on then _all_ OCSP
requests would go to that url. If that responder couldn't return a
correctly-signed response then people couldn't load their sites. If it's
a corporate responder it won't actually be able to sign the OCSP
responses, so at best it could only work as a proxy to the real OCSP
responders.

Maybe it was useful to cache responses for a corporate network, so you
could set a policy of hard-fail and not worry as much about the CA's
responders being down. Or seemed useful in theory -- I don't recall any
fuss when we removed it.

-Dan Veditz