Check server certificate OCSP first, send subsequent queries via SSL. | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		pedro2 on Nov 14, 2020 \| parent \| context \| favorite \| on: Does Apple really log every app you run? A technic... Check server certificate OCSP first, send subsequent queries via SSL.

lstamour on Nov 15, 2020 [–]

Precisely. This would require more work, but it would only leak the OCSP server’s revocation request, and would make OCSP both more secure (caching OCSP server validity rather than the original certificates) and more private (due to SSL).

Consider applying for YC's Summer 2026 batch! Applications are open till May 4
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact