Subject: OCSP Stapling

From: Glen <[email-masked]>
Date: Mon, 1 Aug 2016 11:58:13 -0700

Dear IETF Community:

At IETF-Action, we received the following request:

> Currently I cannot view anything on the IETF website because your
> certificate authorities OCSP server is down and I cannot verify that
> the certificate has not been revoked.
> Please enable OCSP stapling on your webservers so that in the future
> your availability in browsers that require OCSP checks (Firefox with
> strict revocation checks enabled in my case) can still access your
> site without it being dependant on your CAs OCSP service.

I have referred this matter to the TMC, and they have asked me to
refer this out to the community.

Absent any objections to this, we will enable OCSP Stapling as
requested later this week.  If there are any objections or comments,
please make them known on this list for community debate.  (Although I
don't normally follow the IETF list, I will be doing so for the
duration of the discussion.)

Thank you for your review of this matter!

Glen
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: Yoav Nir <[email-masked]>
Date: Tue, 2 Aug 2016 00:34:17 +0300

Good idea. It’s also a best practice as defined in the recent BCP document (bottom of section 6.5 of RFC 7525)

Yoav

> On 1 Aug 2016, at 9:58 PM, Glen <[email-masked]> wrote:
> 
> Dear IETF Community:
>

---

From: Sam Whited <[email-masked]>
Date: Mon, 22 Aug 2016 11:09:30 -0500

On Mon, Aug 1, 2016 at 1:58 PM, Glen <[email-masked]> wrote:
> requested later this week.

Hi Glen et al,

Original requester here:

Since there were no objections, is there any chance we can go ahead
and deploy this? I've had a few more times where the OCSP server goes
down temporarily or just has trouble handling the request.

Thanks,
Sam

-- 
Sam Whited
pub 4096R/54083AE104EA7AD3

---

From: Glen <[email-masked]>
Date: Mon, 22 Aug 2016 09:46:18 -0700

Sam -

This was done as announced and scheduled, and appears to be configured
and working properly, both on our server directly, and through
CloudFlare.  Various tests I've run seem to confirm that OCSP Stapling
is completed.

If anyone continues to have trouble, please contact us at
[email-masked], or reach out to me directly, and we'll do
whatever we can to assist.

Glen
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: Sam Whited <[email-masked]>
Date: Mon, 22 Aug 2016 12:25:54 -0500

Glen,

> whatever we can to assist.

I'm still not seeing this; was it also enabled for tools.ietf.org
where the RFCs live?

$ openssl s_client -connect tools.ietf.org:443 -tls1  -tlsextdebug
-status 2>&1 | grep "OCSP response"
OCSP response: no response sent

—Sam

CCed  [email-masked]

---

From: Glen <[email-masked]>
Date: Mon, 22 Aug 2016 10:30:12 -0700

Sam -

tools.ietf.org server are not operated by AMS.  Those are
volunteer-owned servers, owned and operated by Henrik Levkowetz.

You can contact him directly at <[email-masked]> - I recommend
reaching out to him there.

Thanks,
Glen

---

From: Sam Whited <[email-masked]>
Date: Mon, 22 Aug 2016 12:37:25 -0500

> volunteer-owned servers, owned and operated by Henrik Levkowetz.

I see; sorry for the confusion, and thanks!

Best,
Sam