OCSP Stapling: Optimising certificate validation

Server-side OCSP for certificate validation: less traffic, more privacy and increased efficiency – a step towards future-oriented web security.

A valid SSL certificate signed by a trusted certification authority (CA) is essential for websites today. Browsers use the Online Certificate Status Protocol (OCSP) to check the validity in real timein accordance with the X.509 standard. The ongoing optimisation of certificate validation is therefore a central aspect of web and network security. An effective method for this is the so-called server-side OCSP (also known as OCSP stapling). It enables the web server to take over the certificate validation from the browser (client) and make the request to the OCSP responder. The server then embeds the OCSP response in the SSL/TLS handshake and passes it to the client together with the certificate. Compared to client-side validation, this offers several advantages:

1. Reduced traffic and increased performance:

OCSP stapling significantly reduces traffic between clients and certificate authorities. The reduced server load leads to improved performance, especially with large volumes of traffic. An outstanding example is Let’s Encrypt, which has to cope with an impressive 100,000 OCSP requests per second.

2. Improved client privacy:

When certificate validation is performed on the server side, certificate authorities no longer have insight into the URLs accessed by clients. This helps to protect user privacy.

Implementation and effects

The implementation of OCSP stapling is relatively straightforward. The web server extracts the OCSP URL from the certificate and regularly checks that the certificate has not been revoked. This information is then passed on to the client, which then does not perform any further OCSP checks. We used to process OCSP stapling requests via the proxy-out as standard. However, this occasionally led to disruptions in the event of CDN failures. Therefore, these requests are now made directly – without a diversion via a proxy – in order to increase stability and reliability. Our initial implementations in the infrastructure have also shown that more components are involved than originally assumed. Especially on the WAFs, the interaction with the Apache HTTP server led to reduced availability. As availability is the top priority for business-critical infrastructure, we only implement OCSP stapling on the WAFs at the express request of the customer.

Use OCSP stapling with a sense of proportion

OCSP stapling can significantly improve the performance and security of certificate validation. However, practice shows that its implementation harbours technical subtleties – especially in complex hosting environments. We therefore recommend a needs-based introduction and individual testing depending on the system architecture.