March 2012
- Browser Revocation Behavior Needs Improvement
Today the best behaving client for revocation behavior is that of Windows, in the case of browsers that means IE and Chrome.
- OCSP Responder Performance Needs Improvement
Recently I set up a PingDom monitor to track the overall performance of the various OCSP responders out there, PingDom is limited to doing GETs and cannot parse the responses from the responders but it’s a fair mechanism…
- How to do OCSP requests using OpenSSL and CURL
It pretty easy, the OpenSSL and CURL manuals make it fairly easy but I thought I would put it all here in a single post for you.
- Hard revocation checking and why it’s not here yet.
If you follow discussions around x.509 and SSL you have likely heard that “Revocation Checking is Broken”, you might even hear it will never work therefore we should start over with a technology that isn’t dependent on…
- Using OpenSSL to create a test Qualified Subordination PKI hierarchy
The other day posted about "Least Privilege and Subordinate Certificate Authorities", this post talked about how you can delegate only a limited set of rights to a subordinate CA. I thought you might find a set of…