Since the beginning of July I have intermittent trouble loading SO because I randomly can't verify the CDN's SSL certificate through OCSP. Network connectivity is otherwise good (
ping show no issues).
traceroute tail in case it could be useful:
8 prs-b4-link.telia.net (184.108.40.206) 55.109 ms 40.695 ms 40.548 ms 9 prs-bb1-link.telia.net (220.127.116.11) 42.226 ms prs-bb1-link.telia.net (18.104.22.168) 40.901 ms prs-bb2-link.telia.net (22.214.171.124) 72.523 ms 10 prs-b8-link.telia.net (126.96.36.199) 42.703 ms 42.402 ms prs-b8-link.telia.net (188.8.131.52) 42.796 ms 11 cloudflare-ic-154355-prs-b8.c.telia.net (184.108.40.206) 42.739 ms 39.734 ms 39.572 ms 12 220.127.116.11 (18.104.22.168) 41.527 ms 42.248 ms 39.711 ms
When I use relaxed (aka. "soft-fail") OCSP verification in my browser (Iceweasel/Firefox 22 on Debian Jessie: Preferences > Advanced > Encryption > Validation > uncheck "When the connection to a OCSP server fails, consider the certificate as invalid") the issue disappears.
Note that this problem is specific to SO (or at least to GlobalSign -- the provider of
cdn.sstatic.net's SSL certificate), I use a lot of SSL sites and no other exhibits this OCSP issue.
This bug is worrying because it forces us to lower our browser security settings if we want to continue using SO, making it easier for rogue sites to exploit SSL certification flaws...
If you need more information to help debug this issue, please tell me.