Understanding of OCSP Stapling

Sun and Moon Pagodas, Shanhu Lake, Guilin, China

What's OCSP Stapling?

OCSP stapling, also known as the TLS Certificate Status Request extension, is an alternative approach to the Online Certificate Status Protocol (OCSP) for checking the revocation status of X.509 digital certificates. It allows the presenter of a certificate to bear the resource cost involved in providing OCSP responses, instead of the issuing Certificate Authority (CA). [WIKI]

With OCSP stapling, it is the responsibility of the web site to get the OCSP response and send OCSP response to clients/browsers in SSL/TLS handshaking.

OCSP stapling is defined as TLS Certificate Status Request extension in section 8 of RFC 6066.

The Benefits of OCSP Stapling

1. The performance bottleneck of OCSP server
   If client checks the certificate status directly from OCSP server, for each client with a given certificate, the OCSP server has to response with a particular certificate status. For high traffic web site, OCSP server is likely to be the performance bottleneck.  The client side also need more cycles (DNS, networking, CPU etc.) to communicate with OCSP server.
   
   OCSP stapling can save OCSP query cost of both OCSP server and clients.  The certificate holder (the server), rather than the client, queries the certificate status from OCSP server in a regular interval.  And the OCSP response can be used directly by client side in a "stapled" approach.  Note that the server performance impact is pretty limited as the OCSP response (valid from hours to days) can be cached and used repeatedly in the valid period.
   
   The performance impact has very bad side effect that browsers/clients may choose to disable certificate status checking or continue the TLS handshaking if the OCSP server is not accessible (for example, Firefox will continue the connection if it cannot connect to the CA, and the same for IE).
   
   According to a report from CloudFlare, OCSP stapling can make SSL 30% faster.
   
   
2. The potential privacy impairment of OCSP request
   In normal OCSP scenarios, when client requests a OCSP service, it exposes both the server (via server certificate entry) and itself (via IP address at least) to OCSP server, and hence disclose the browser behaviors.  A way to verify validity without disclosing browsing behavior would be desirable for some groups of users.
   
   OCSP stapling solved this issue because client won't need to query OCSP server any more, while server queries of OCSP status won't disclose any client information at all.
   
   
3. The limitation of the Captive Portal technique
   The captive portal technique forces an HTTP client on a network to see a special web page (usually for authentication purposes) before using the Internet normally.   In such environments,  clients are not able to check OCSP status of the SSL/TLS certificate since all Internet access is blocked until authentication is successful.
   
   There is no such limitation with OCSP stapling as OCSP status is stapled within the target SSL handing processes. 

The deployment of OCSP Stapling

In Server side,

• Apache HTTP Server supports OCSP stapling since version 2.3.3, with SSLUseStapling Directive
• Nginx web server supports OCSP stapling since version 1.3.7/1.4.0, with ssl_stapling directive.
• Microsoft IIS web server supports OCSP stapling since version 7. The feature is enabled by default. It is also enabled in Kerberos PKINIT.

In client side,

• Beginning with Windows Server 2008, Kerberos clients will request OCSP stapling when using PKINIT by default. 
• Firefox,  since version 25 (and this link).
• IE (it is said OCSP stapling is supported since Vista, but I did not get the declare yet.  IE 10 does support OSCP stapling according to my test.)
• Google Chrome browser (no data so far when it get supported.  Chrom version 30 does support it according to my test)
• Opera browser (no date so far when it get supported. Opera 12.11 does support it according to my test)

TLS Vendors,

• The OpenSSL project included support in their 0.9.8h since 2008, please also take care of the OCSP stapling vulnerability in OpenSSL.
• Microsoft IIS/Schennel support OCSP stapling since version 7.
• NSS supports OCSP stapling since version 3.15.

Why a SSL/TLS vendor need this feature

1. Because of performance, we cannot enable OCSP checking on TLS client side by default.  Chrome had decide to disable OCSP checking because of performance.  However, if check certificate status cannot be checked, there is a security issue if certificate has been revoked.
2. Support OCSP stapling in server side boost the performance and improve security of client sides who supports OCSP stapling.
3. OCSP based certificate status checking of TLS cannot work in a certain environment, for example in Captive Porta environment.
4. It's required to check certificate status for EV certificate.
5. Generally, Java based SSL web server, for example Tomcat/Glassfish,  may also want to support OCSP stapling to better service its customers and compete with other platform, for example Apachs HTTP server, Nginx and Microsoft IIS.
6. OCSP stapling has been widely supported in the industry in both client and server.