Re: OCSP stapling problems

2014-03-14 Thread David Keeler
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 03/14/14 07:18, Hanno Böck wrote: > However, I'd really like to stress again that I'd find it a very > worrying signal if this issue will stay unfixed for three more > major firefox versions to come. I'm pretty sure if at some point we > want to ge

Re: OCSP stapling problems

2014-03-14 Thread Hanno Böck
On Tue, 11 Mar 2014 11:01:26 -0700 Brian Smith wrote: > It would be great if you could test the new way of doing > certificate/OCSP verification. To do so, please download Firefox 30 > Nightly from http://nightly.mozilla.org/. After you install it, go to > about:config and add a new entry: > > 1

Re: OCSP stapling problems

2014-03-11 Thread Hanno Böck
On Tue, 11 Mar 2014 11:01:26 -0700 Brian Smith wrote: > First, it is important to point out to others reading this that this > problem only affects certificates that don't chain to a trusted root > CA and/or which are considered invalid by Firefox for some other > reason. AFAICT, there is no prob

Re: OCSP stapling problems

2014-03-11 Thread Brian Smith
On Tue, Mar 11, 2014 at 3:20 AM, Hanno Böck wrote: > I wanted to bring up an issue regarding OCSP stapling. > I filled this bug shortly after Firefox 27 came out: > https://bugzilla.mozilla.org/show_bug.cgi?id=972304 > > Short conclusion: If you have enabled OCSP stapling on your server this > wi

OCSP stapling problems

2014-03-11 Thread Hanno Böck
Hello, I wanted to bring up an issue regarding OCSP stapling. I filled this bug shortly after Firefox 27 came out: https://bugzilla.mozilla.org/show_bug.cgi?id=972304 Short conclusion: If you have enabled OCSP stapling on your server this will break the possibility to add certificate exceptions w