10

Since the beginning of July I have intermittent trouble loading SO because I randomly can't verify the CDN's SSL certificate through OCSP. Network connectivity is otherwise good (traceroute & ping show no issues).

Here's the traceroute tail in case it could be useful:

 8  prs-b4-link.telia.net (213.248.85.1)  55.109 ms  40.695 ms  40.548 ms
 9  prs-bb1-link.telia.net (213.155.135.190)  42.226 ms prs-bb1-link.telia.net (213.155.135.192)  40.901 ms prs-bb2-link.telia.net (213.155.135.200)  72.523 ms
10  prs-b8-link.telia.net (213.155.132.225)  42.703 ms  42.402 ms prs-b8-link.telia.net (213.155.131.17)  42.796 ms
11  cloudflare-ic-154355-prs-b8.c.telia.net (80.239.194.118)  42.739 ms  39.734 ms  39.572 ms
12  190.93.245.58 (190.93.245.58)  41.527 ms  42.248 ms  39.711 ms

When I use relaxed (aka. "soft-fail") OCSP verification in my browser (Iceweasel/Firefox 22 on Debian Jessie: Preferences > Advanced > Encryption > Validation > uncheck "When the connection to a OCSP server fails, consider the certificate as invalid") the issue disappears.

Note that this problem is specific to SO (or at least to GlobalSign -- the provider of cdn.sstatic.net's SSL certificate), I use a lot of SSL sites and no other exhibits this OCSP issue.

This bug is worrying because it forces us to lower our browser security settings if we want to continue using SO, making it easier for rogue sites to exploit SSL certification flaws...

If you need more information to help debug this issue, please tell me.

Improve this question
7
  • I have been seeing the same thing. If I use Fiddler and capture https traffic and decrypting, the files appear.
    – Jeff Cuscutis
    Commented Jul 11, 2013 at 13:32
  • I have the same problem ... but only with Firefox (v22.0, Linux). With Chromium, everything works.
    – Paul Gaborit
    Commented Jul 19, 2013 at 23:28
  • @PaulGaborit I don't know Chromium well, does it have an option to enforce OCSP like Firefox does? From what I can judge from Chrome (which I don't know well either) this browser family seems to focus on hiding advanced options to the end-user rather than exposing them, which could explain the difference in behaviour if OCSP is merely optional.
    – syam
    Commented Jul 19, 2013 at 23:42
  • @syam You are right: Chromium has not these advanced options to enforce OCSP..
    – Paul Gaborit
    Commented Jul 19, 2013 at 23:47
  • 1
    Looks like Opera has the same problem. This bug is worrying because it forces us to lower our browser security settings if we want to continue using SO, making it easier for rogue sites to exploit SSL certification problems... :(
    – syam
    Commented Jul 20, 2013 at 0:02
  • 2
    @syam An article about Chrom(e|ium) and OCSP: Google Chrome will no longer check for revoked SSL certificates online.
    – Paul Gaborit
    Commented Jul 20, 2013 at 7:42
  • @PaulGaborit Thanks for that article. At least I agree with part of it: soft-fail OCSP is completely useless and doesn't protect against anything (hence my concern). But I don't agree with the conclusion that OCSP should be disabled altogether: it's the first time ever I experience an issue with OCSP, so the system works and exceptional problems such as this one should be fixed at the provider's side, not by requiring us to expose ourselves. Call me paranoid. :)
    – syam
    Commented Jul 20, 2013 at 11:53

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .