Collaborate Disseminate
I am hoping I can leverage everyone’s knowledge on this one as I am at a lose.
I have an Android 10 Device connecting to a containerized web application that is secured by a custom Certificate Authority. The OCSP addresses in the certific… Continue reading Android Certificate Revocation Checking
Trying to understand OCSP stapling and OCSP must-staple, I’ve read multiple explanations, but I still don’t understand what makes OCSP must-staple secure.
My understanding is that, during TLS, the clients request the server certificate fro… Continue reading Why is OCSP must-staple secure?
What’s the advantage of using OCSP stapling with some OCSP response validity period compared to a TLS certificate with the same short validity period which would have to be renewed at the same interval as the (stapled) OCSP response would … Continue reading Advantage of using OCSP stapling compared to frequently renewed TLS certificates without OCSP
I am a privacy-conscious user currently living in Russia where the Internet is censored and monitored by the Russian state. Russian ISPs are legally required to log and store all users’ Internet traffic (even though in practice they seem t… Continue reading Do VPNs log and analyze OCSP requests?
I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is valid or not. I know that when we send a… Continue reading How does the client get the certificate (and public key) of the delegated authority (OCSP responder) to confirm the response in OCSP?
I have an assignment in which I have to implement OCSP and do a proof of concept of a vulnerability.
My idea was to implement OCSP without using a nonce (this is done) and then perform a replay attack. However I’m having trouble doing the … Continue reading Any vulnerability of OCSP for proof of concept
For an assignment I have to implement a proof of concept and (optionally attack it). The part of OCSP is working so far. I have a client that sends the request to a server, the server verifies if the certificate is valid. But I wanted to d… Continue reading Implement Replay attacks in python [closed]
I’m interested in the status of OCSP respect in modern browsers (particularly the one I’m using right now).
Is there any website that will allow me to test how my browser treats the status_request SecurityPolicy?
I know that you can use SS… Continue reading OCSP Must-Staple test website?
I am building a Certificate Authority using Windows Server ADCS as a ‘Standalone’ CA but my application would be greatly improved if I can utilise OCSP.
Is the ADCS Online Responder Role Service appropriate to be exposed on the public inte… Continue reading Exposing ADCS OCSP on the Public Internet
Learning abit about allowed OCSP hosts on Windows 10:
I’ve picked up OCSP requests carried out by CryptSvc pointing towards an OCSP server in Japan. Referring to Microsoft’s Win10 Non-enterprise endpoint lists, I’ve already witnessed and c… Continue reading OCSP hosts. How to tell Malicious OCSP hosts apart