Confirmed users
529
edits
Security/Server Side TLS: Difference between revisions
m
Added OCSP Stapling Diagram
(Version 3.4: ulfr: added note about session resumption, HSTS and HPKP) |
m (Added OCSP Stapling Diagram) |
||
| Line 202: | Line 202: | ||
The server will send a cached OCSP response only if the client requests it, by announcing support for the '''status_request''' TLS extension in its CLIENT HELLO. | The server will send a cached OCSP response only if the client requests it, by announcing support for the '''status_request''' TLS extension in its CLIENT HELLO. | ||
[[File:OCSP_Stapling.png]] | |||
Most servers will cache OCSP response for up to 48 hours. At regular intervals, the server will connect to the OCSP responder of the CA to retrieve a fresh OCSP record. The location of the OCSP responder is taken from the Authority Information Access field of the signed certificate. For example, with StartSSL: | Most servers will cache OCSP response for up to 48 hours. At regular intervals, the server will connect to the OCSP responder of the CA to retrieve a fresh OCSP record. The location of the OCSP responder is taken from the Authority Information Access field of the signed certificate. For example, with StartSSL: | ||