Xuelei Fan's Blog

Sun and Moon Pagodas, Shanhu Lake, Guilin, China What's OCSP Stapling? OCSP stapling, also known as the TLS Certificate Status Request extension, is an alternative approach to the Online Certificate Status Protocol (OCSP) for checking the revocation status of X.509 digital certificates. It allows the presenter of a certificate to bear the resource cost involved in providing OCSP responses, instead of the issuing Certificate Authority (CA). [ WIKI ] With OCSP stapling, it is the responsibility of the web site to get the OCSP response and send OCSP response to clients/browsers in SSL/TLS handshaking. OCSP stapling is defined as TLS Certificate Status Request extension in section 8 of RFC 6066 . The Benefits of OCSP Stapling The performance bottleneck of OCSP server If client checks the certificate status directly from OCSP server, for each client with a given certificate, the OCSP server has to response with a particular certificate status. For high traf...

Aged Bridge, Yulong River, Yangshuo, China Why Key Size Concerns The key size is an important security parameter to determine the strength of cryptography algorithms. For example, RSA keys with fewer than 1024 bits are considered forgeable.  If RSA keys less than 1024 bits are used in X.509 certificates, the private keys used in these certificates can be derived and could allow an attacker to duplicate the certificates and use them fraudulently to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. On August 14, 2012, Microsoft offered an update to Windows that restricts the use of certificates with RSA keys less than 1024 bits in length.  As of October 9, 2012, the update is delivered via automatic update through the Microsoft update service.  Microsoft recommends that customers apply the update at the earliest opportunity. Since JDK 7u12,  RSA keys less than 1024 bits in X.509 certificates are disabled.  This...