Home / server / Questions / 325253
Accepted
ripper234
Asked: 2011-10-28 00:16:17 +0800 CST

When are OCSP requests sent by web browsers?

  • 772

I'm testing my https page via webpagespeedtest on IE8, and in one run I noticed a bunch of OSCP requests sent to oscp.godaddy.com. I never noticed any such requests in previous runs.

When do browsers decide to send such requests? Does it have to do with the fact I moved hosting providers yesterday?

ssl ocsp

1 Answers

  1. Best Answer

    IE relies on CryptoAPI for performing any certificate revocation/status checking task, so chances are:

    • an SSL certificate was presented to the browser
    • this was validated using the chain of CDPs listed by that certificate, and any CA CDPs (CRL Distribution Points - URLs from which CRLs are available) in the chain of certificates that were issued
    • a valid version of the CRL for a certificate in its issuance chain wasn't cached locally

    And so CryptoAPI's chaining engine decided it needed newer information on whether one of those certificates had been revoked recently or not.

    Any given operation on a certificate might cause CRL retrieval or OCSP-based checking; Windows will cache the CRL response for its validity period (or an OCSP response as specified by its max-age HTTP header), which might explain why you see it once in a while, but not regularly/frequently.

    To "walk the chain" of CDPs yourself, open the certificate and go to the Certification Path tab - this shows the hierarchy of CAs which produced the certificate. Open each one, and look at its Details tab - the CRL location(s) at each level are what the client needs to check and cache in order to fully trust the certificate (the issuing Root must be trusted by your machine for anything in the chain to work); if OCSP is enabled, the AIA extensions are signficant as well.

    Alternatively, save out the cert to a .CER file, and run the always-hilarious 

    CERTUTIL -verify -urlfetch mycert.cer

    command to see the chaining engine in action.

    • 4