On Thu, May 03, 2012, Alexander Komyagin wrote: > Thanks for the note, Stephen! I'll certainly take this into account. > If I incorporate OCSP check in check_revoked() function, which is called > during SSL connect/handshake it would just block during connect op for a > while, and I believe that no single service shall expect connection > establishment to be fast. Good service will handle other connections in > a separate thread for the sake of availability, won't it? >
That can also occur during a renegotiation. Some applications handle multiple connections in one thread using non-blocking I/O, in that case the OCSP query would affect the progress of all connections. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
