What is OCSP Stapling & How to Optimising Certificate Validation?

Related Post

OCSP stapling simplifies SSL/TLS certificate validation, overcoming the performance, privacy, and reliability challenges of traditional methods. By storing certificate state on the server and sharing it during TLS stapling, OCSP stapling ensures faster and more secure connections.

OCSP Stapling is a method to verify the revocation status of an SSL/TLS certificate in a better way than the original Online Certificate Status Protocol (OCSP). With OCSP Stapling, the web server will fetch the certificate revocation status in advance and send it to the browser during the SSL/TLS handshake process.

Read: Why SSL Certificates are Revoked and How to Prevent it?

What is OCSP?

What is OCSP?

Online Certificate Status Protocol (OCSP) helps in providing server certificate revocation status for Transport Layer Security (TLS) handshake. OCSP Stapling server certificates provides real-time revocation status checking, reducing the latency associated with revocation status checking, and improving the privacy and reliability of secure connections.

1. Key concepts

The following key concepts provide details about Online Certificate Status Protocol (OCSP).

a. OCSP

OCSP is used to check the revocation status of certificates during Transport Layer Security (TLS) handshake. OCSP enables real-time validation of certificates. It confirms that a certificate has not been revoked or expired since it was issued. 

OCSP is also more scalable compared to traditional Certificate Revocation Lists (). OCSP response CRLs are smaller and can be generated efficiently, making them more suitable for large-scale Private Key Infrastructures (PKIs).

b. OCSP Responder

OCSP Responder (also known as OCSP server) receives and responds to OCSP requests from clients seeking to verify the revocation status of certificates.

c. OCSP Client Side

On the OCSP client side, clients use OCSP to contact OCSP responder to check the revocation status of certificates during Transport Layer Security () handshake. TLS

d. OCSP server side

In OCSP server side (also known as OCSP stapling), the server is enabled (not the client) to make a request to the responder. The OCSP server staples the OCSP response to the certificate and returns it to the client during the TLS handshake.

2. OCSPdiagram

The following diagram illustrates how OCSP client side and server side work. 

What is OCSP?

a. Client side OCSP

• The client sends a ClientHello message to initiate a TLS handshake with the server.
• The server receives the message and responds with a ServerHello message. The server also sends the server's certificate to the client.
• The client validates the server's certificate and extracts the OCSP URI from it.
• The client sends a certificate revocation check request to the responder. OCSP
• OCSPThe responder sends an OCSP response.
• The client validates the certificate status from the OCSP response.

TLSHandshake complete.

b. Server side OCSP

• The client sends a ClientHello message to initiate a TLS handshake with the server.
• The server receives the message and gets the latest cached OCSP response. If the cached response is lost or expired, the server calls the responder's OCSP for the certificate status.
• OCSPThe responder sends an OCSP response to the server.
• The server sends a ServerHello message. The server also sends the server's certificate and certificate status to the client.
• The client validates the certificate's OCSP status.
• TLSHandshake complete.

Simply, The Online Certificate Status Protocol (OCSP) is a real-time method for verifying the validity of SSL/TLS certificates. Managed by Certificate Authorities (CAs), OCSP allows browsers to confirm whether a certificate is:

• Valid
• Revoked
• Unknown

This process prevents users from trusting revoked certificates, preserving the integrity of encrypted communications.

You can test your OCSP response time by:

openssl s_client -Connecting examples.com:443 -statues

openssl oksp -chain publisher.pem -certificate certificate.pem -teks \
-url http://ocsp.your-ca.com

What is OCSP Stapling?

OCSP stapling shifts certificate validation from the browser to the server. Instead of the browser asking the CA, the server obtains and stores the OCSP response, which it provides to the browser during the SSL/TLS handshake process.

AWS IoT Core supports Online Certificate Status Protocol (OCSP) Stapling for server certificates, also known as server certificate stapling, or OCSP OCSP stapling. It is a security mechanism used to check the revocation status of a server certificate in a Transport Layer Security (TLS) handshake.

OCSPstapling in AWS IoT Core lets you add an additional layer of verification to the validity of your custom domain server certificates. You can enable OCSP stapling of AWS IoT Core server certificates to check the validity of certificates by periodically querying responders. 

OCSP Setting up OCSP stapling is part of the process for creating or updating a domain configuration with a custom domain. OCSPstapling checks the revocation status of server certificates continuously. This helps verify that any certificates that have been revoked by a CA are no longer trusted by clients connecting to your custom domain.

How OCSP stapling works?

OCSP stapling is used during the Transport Layer Security (TLS) handshake between a client and a server to check the revocation status of the server’s certificate. The server makes an OCSP request to an OCSP responder and staples the OCSP response to the certificate returned to the client. By having the server make requests to an OCSP responder, the response can be cached and then used multiple times for multiple clients.

The following diagram shows how server-side OCSP stapling works. AWS IoT Core

How OCSP stapling works?

Explanation:

• The device must be registered with a custom domain with OCSP stapling enabled.
• AWS IoT Core calls the OCSP responder every hour to get the certificate status.
• The OCSP responder receives the request, sends the latest OCSP response, and caches the responseOCSP.
• The device sends a ClientHello message to initiate a TLS handshake with. AWS IoT Core
• AWS IoT Core gets the latest OCSP response from the server cache, which responds with the OCSP certificate response.
• The server sends a ServerHello message to the device. The server also sends the server certificate and certificate status to the client.
• The device validates the OCSP status of the certificate.
• TLSHandshake completes.

Challenges with Traditional OCSP

While OCSP replaces the bulky CRL, it introduces its own set of challenges:

1. Performance Issues

Each browser request to the CA’s OCSP responder adds latency to the SSL/TLS handshake, slowing down page load times and frustrating users.

2. Privacy Concerns

OCSP queries expose user browsing data to the CA, since the domain being checked is part of the query.

3. Soft-Fail Weaknesses

Most browsers use soft-fail mode, meaning that:

If the OCSP responder is unavailable, the browser continues the connection, assuming the certificate is valid.

An attacker can exploit this by blocking the OCSP request and bypassing the revocation check.

What are the benefits of OCSP stapling?

Some of the benefits of using OCSP stapling of server certificates are summarized as follows:

1. Enhanced privacy

Without OCSP stapling, client devices can expose information to third-party OCSP responders, potentially compromising user privacy. OCSPstapling mitigates this issue by having the server retrieve the OCSP response and send it directly to the client.

2. Enhanced reliability

OCSPstapling can improve the reliability of secure connections because it reduces the risk of server OCSP outages. When an OCSP response is stapled, the server includes the most recent response with the certificate. This is so that clients have access to the revocation status even if the OCSP responder is temporarily unavailable. 

OCSPstapling helps mitigate this issue because the server periodically retrieves the OCSP response and includes the cached response in the TLS handshake, reducing the reliance on the responder’s real-time availability. OCSP

3. Reduced server load

OCSPstapling offloads the burden of responding to OCSP requests from the OCSP responder to the server. This can help distribute the load more evenly, making the certificate validation process more efficient and scalable.

4. Reducing latency

OCSPstapling reduces the latency associated with checking the revocation status of a certificate during the TLS handshake. Instead of the client having to query the server's OCSP separately, the server sends a request and attaches the response OCSP with the server's certificate during the handshake.

Simply, this are another benefit of OCSP Stapling:

• Faster SSL/TLS Handshake: Eliminates the need for the browser to query the CA, reducing connection delays.
• Enhanced Privacy: The user’s browsing activity remains private, since OCSP queries are no longer sent to the CA.
• Enhanced Reliability: The browser relies on the OCSP response provided by the server, reducing reliance on CA availability.
• Reduced Bandwidth Usage: The server handles OCSP requests in batches, minimizing network traffic.
• Improved User Experience: Faster handshakes and reduced latency increase trust and satisfaction.

What are the disadvantages of OCSP?

• Server Resource Usage: Fetching and storing OCSP responses increases processing and memory overhead on the server.
• Limited Client Support: Older browsers or non-compliant clients may not support OCSP stapling, falling back to traditional OCSP queries.
• Lowering the Risk of No-Staple Attacks: Attackers can bypass stapling by presenting a certificate without a stapled response unless the certificate includes the Must-Staple extension.

Enhancing OCSP Stapling with Must-Staple

The Must-Staple extension ensures that a certificate always comes with a stapled OCSP response. If the response is missing, the browser will reject the connection.

1. Must Staple Benefits

• Reduce downgrade attacks by enforcing stapled responses.
• Reduce unnecessary OCSP traffic to the CA.
• Strengthen security for high-value certificates.

To enable Must-Staple, contact your CA for support.

How to implement OCSP stapling?

1. Apache

Add these directives to your SSL configuration file:

Use of SSLStapling          on
SSLStaplingCache        shmcb:/var/jalankan/ocsp(128000)
SSLStapling Response TimeOut 5

Restart Apache:

sudo systemctl Restart apache2

2. Nginx

Add the following configuration to your server block:

ssl_stapling actif;
ssl_stapling_verification actif;
finisher 8.8.8.8;
ssl_trusted_certificate /path/menuju/rantai.pem;

Restart Nginx:

udo systemctl Restart nginx

Testing and Verifying OCSP Stapling

1. Browser Testing

Open your browser's developer tools (e.g., Chrome's Security tab) and check the certificate status for stapling.

2. Command Line Testing

Use OpenSSL to check the stapled response:

openssl s_klien -Connecting yourdomain.com:443 -status

Confirm the OCSP Response section is present in the output.

Troubleshooting OCSP Stapling

1. No Stapled Response

Ensure your server can reach the CA’s OCSP responder.

Verify that all intermediate certificates are included in the certificate chain.

2. Invalid Response

Synchronize your server’s clock with an NTP server to avoid timestamp issues.

3. Memory Overhead

Optimize your OCSP caching configuration for high-traffic environments.

Important notes for using OCSP server certificate stapling in AWS IoT Core

When you use AWS IoT Core server OCSP certificates, keep the following in mind:

1. AWS IoT Core only supports OCSP responders that are reachable via public IPv4 addresses
2. The OCSP stapling feature in AWS IoT Core does not support authorized responders. All OCSP responses must be signed by the CA that signed the certificate, and the CA must be part of the custom domain’s certificate chain.
3. The OCSP stapling feature in AWS IoT Core does not support custom domains created using self-signed certificates.
4. AWS IoT Core calls the OCSP responder every hour and caches the response. If a call to the responder fails, AWS IoT Core staples the most recent valid response.
5. If nextUpdateTime is no longer valid, AWS IoT Core removes the response from the cache, and the TLS handshake does not include the response OCSP data until the next successful call to the OCSP responder. This can happen when the cached response has expired before the server gets a valid response from the responder. OCSP The nextUpdateTime value indicates that the OCSP response will be valid up to this point. For more information about nextUpdateTime, see Server certificate log OCSP entries.
6. Sometimes, AWS IoT Core fails to receive an OCSP response or deletes an existing OCSP response because it has expired. If this situation occurs, AWS IoT Core will continue to use the server certificate provided by the custom domain without the OCSP response.
7. The OCSP response size must not exceed 4 KiB.

Note:

AWS IoT Core emits the RetrieveOCSPStapleData.Success metric and the RetrieveOCSPStapleData log entry to CloudWatch. The metric and log entry can help detect issues related to retrieving OCSP responses.

Read: What is the HTTP/2 Protocol & How do they Affect Web Performance?

Conclusion

OCSP Stapling addresses the performance, privacy, and reliability challenges of traditional revocation checking. By pairing it with Must-Staple, you can further protect your website from security threats such as downgrade attacks.

Implement OCSP stapling on your servers today to improve performance and user trust. For further guidance, your Certificate Authority’s documentation and technical support teams can provide additional context and assistance...