Subject: [pkix] Off-topic: OCSP response times and drop rates

From: Paul Hoffman <[email-masked]>
Date: Mon, 22 Apr 2013 14:33:21 -0700

http://news.netcraft.com/archives/2013/04/22/ocsp-server-performance-in-march-2013.html

---

From: "Jeremy Rowley" <[email-masked]>
Date: Mon, 22 Apr 2013 16:36:15 -0600

This site has similar information about size and uptimes, but in a graph
format so you can see fluctuations
http://ocspreport.x509labs.com/

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul
Hoffman
Sent: Monday, April 22, 2013 3:33 PM
To: [email-masked] PKIX
Subject: [pkix] Off-topic: OCSP response times and drop rates

http://news.netcraft.com/archives/2013/04/22/ocsp-server-performance-in-marc
h-2013.html
_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: [email-masked] (Martin Rex)
Date: Tue, 23 Apr 2013 01:45:11 +0200 (CEST)

> http://news.netcraft.com/archives/2013/04/22/ocsp-server-performance-in-march-2013.html

I'm running CertificatePatrol on highest warning level in Firefox
and on a recent certificate change (I believe gh.ebaystatic.com),
a 1024-bit RSA cert with OCSP AIA (IIRC Akamai) was replaced by
a 2048-bit RSA cert _without_ OCSP AIA (only CRLDP).

Under the same root (Baltimore CyberTrust Root) I also see an
intermediate CA "Microsoft Internet Authority" which has issued
a cert for "apis.live.net" that has only a CRLDP, but no OCSP AIA.

Similar for the CA "Google Internet Authority" under "Equifax Secure CA"

and I can see a few more easily.

To me, the existence of a number of CAs that do not offer
(public) OCSP services at all is more telling than Netcraft
access/performance statistics of some CAs that do offer OCSP.  YMMV.

-Martin

---

From: "Piyush Jain" <[email-masked]>
Date: Mon, 22 Apr 2013 17:17:31 -0700

I'm not sure about the ebaystatic.com certificate that you referred to, but
the other certificates are sub CA certificates.

It is very rare to find OCSP AIAs in subordinate CA certificates and for
good reason.
Root CAs are typically kept offline and they issue certificates/CRLs very
infrequently. 
Size of CRLs issued by these CAs is very small (a few or zero entries), so
it does not make sense to provide revocation status for certificate issued
by such CAs through OCSP from operational perspective. 

-Piyush

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Martin Rex
> Sent: Monday, April 22, 2013 4:45 PM
> To: Paul Hoffman
> Cc: [email-masked] PKIX
> Subject: Re: [pkix] Off-topic: OCSP response times and drop rates
> 
> Paul Hoffman wrote:
> I'm running CertificatePatrol on highest warning level in Firefox and on a
> recent certificate change (I believe gh.ebaystatic.com), a 1024-bit RSA
cert
> with OCSP AIA (IIRC Akamai) was replaced by a 2048-bit RSA cert _without_
> OCSP AIA (only CRLDP).
> 
> Under the same root (Baltimore CyberTrust Root) I also see an intermediate
> CA "Microsoft Internet Authority" which has issued a cert for
"apis.live.net"
> that has only a CRLDP, but no OCSP AIA.
> 
access/performance
> statistics of some CAs that do offer OCSP.  YMMV.
> 
> 
> -Martin

---

From: Erwann Abalea <[email-masked]>
Date: Tue, 23 Apr 2013 11:08:03 +0200

Nice.

The certificates for gh.ebaystatic.com and apis.live.net are not CABForum
BR compliant (lack of OCSP, lack of SAN), but Baltimore already admitted it
in their reply to Mozilla. They said their goal is to achieve all this for
April/May 2014.

2013/4/23 Martin Rex <[email-masked]>

-- 
Erwann.