10

Since the beginning of July I have intermittent trouble loading SO because I randomly can't verify the CDN's SSL certificate through OCSP. Network connectivity is otherwise good (traceroute & ping show no issues).

Here's the traceroute tail in case it could be useful:

 8  prs-b4-link.telia.net (213.248.85.1)  55.109 ms  40.695 ms  40.548 ms
 9  prs-bb1-link.telia.net (213.155.135.190)  42.226 ms prs-bb1-link.telia.net (213.155.135.192)  40.901 ms prs-bb2-link.telia.net (213.155.135.200)  72.523 ms
10  prs-b8-link.telia.net (213.155.132.225)  42.703 ms  42.402 ms prs-b8-link.telia.net (213.155.131.17)  42.796 ms
11  cloudflare-ic-154355-prs-b8.c.telia.net (80.239.194.118)  42.739 ms  39.734 ms  39.572 ms
12  190.93.245.58 (190.93.245.58)  41.527 ms  42.248 ms  39.711 ms

When I use relaxed (aka. "soft-fail") OCSP verification in my browser (Iceweasel/Firefox 22 on Debian Jessie: Preferences > Advanced > Encryption > Validation > uncheck "When the connection to a OCSP server fails, consider the certificate as invalid") the issue disappears.

Note that this problem is specific to SO (or at least to GlobalSign -- the provider of cdn.sstatic.net's SSL certificate), I use a lot of SSL sites and no other exhibits this OCSP issue.

This bug is worrying because it forces us to lower our browser security settings if we want to continue using SO, making it easier for rogue sites to exploit SSL certification flaws...

If you need more information to help debug this issue, please tell me.

  • I have been seeing the same thing. If I use Fiddler and capture https traffic and decrypting, the files appear. – Jeff Cuscutis Jul 11 '13 at 13:32
  • I have the same problem ... but only with Firefox (v22.0, Linux). With Chromium, everything works. – Paul Gaborit Jul 19 '13 at 23:28
  • @PaulGaborit I don't know Chromium well, does it have an option to enforce OCSP like Firefox does? From what I can judge from Chrome (which I don't know well either) this browser family seems to focus on hiding advanced options to the end-user rather than exposing them, which could explain the difference in behaviour if OCSP is merely optional. – syam Jul 19 '13 at 23:42
  • @syam You are right: Chromium has not these advanced options to enforce OCSP.. – Paul Gaborit Jul 19 '13 at 23:47
  • 1
    Looks like Opera has the same problem. This bug is worrying because it forces us to lower our browser security settings if we want to continue using SO, making it easier for rogue sites to exploit SSL certification problems... :( – syam Jul 20 '13 at 0:02
  • 2
    @syam An article about Chrom(e|ium) and OCSP: Google Chrome will no longer check for revoked SSL certificates online. – Paul Gaborit Jul 20 '13 at 7:42
  • @PaulGaborit Thanks for that article. At least I agree with part of it: soft-fail OCSP is completely useless and doesn't protect against anything (hence my concern). But I don't agree with the conclusion that OCSP should be disabled altogether: it's the first time ever I experience an issue with OCSP, so the system works and exceptional problems such as this one should be fixed at the provider's side, not by requiring us to expose ourselves. Call me paranoid. :) – syam Jul 20 '13 at 11:53

You must log in to answer this question.

Browse other questions tagged .