{"id":147,"date":"2012-06-27T22:15:53","date_gmt":"2012-06-28T06:15:53","guid":{"rendered":"http:\/\/unmitigatedrisk.com\/?p=147"},"modified":"2012-09-11T10:46:40","modified_gmt":"2012-09-11T18:46:40","slug":"revocation-repositories-ipv6-support-message-size-and-performance","status":"publish","type":"post","link":"https:\/\/unmitigatedrisk.com\/?p=147","title":{"rendered":"Revocation repositories, IPv6 support, message size, and performance"},"content":{"rendered":"

So the last few weeks I have spent a reasonable amount of time looking at performance and networking related problems associated with revocation repositories. I still have some additional work to do but I figured I would capture some of my findings in a quick post.<\/p>\n

CRL repositories and IPv6<\/h6>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CA<\/strong><\/td>\nHost<\/strong><\/td>\nSupports V6<\/strong><\/td>\n<\/tr>\n
GlobalSign<\/span><\/td>\ncrl.globalsign.com<\/span><\/span><\/a><\/td>\nYes<\/span><\/td>\n<\/tr>\n
Comodo<\/span><\/td>\ncrl.comodoca.com<\/span><\/a><\/td>\nNo\/Sometimes<\/span><\/td>\n<\/tr>\n
CyberTrust<\/td>\nsureseries-crl.cybertrust.ne.jp<\/a><\/td>\nNo<\/td>\n<\/tr>\n
Symantec\/GeoTrust<\/td>\nEVSSL-crl.geotrust.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
Symantec\/VeriSign<\/td>\nEVIntl-crl.verisign.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
DigiCert<\/td>\ncrl3.digicert.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
StartSSL<\/td>\ncrl.startssl.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
TrustWave<\/td>\ncrl.securetrust.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
TrustCenter<\/td>\ncrl.ix.tcclass3.tcuniversal-i.trustcenter.de<\/a><\/td>\nNo<\/td>\n<\/tr>\n
GoDaddy<\/td>\ncrl.godaddy.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
Entrust<\/td>\ncrl.entrust.net<\/a><\/td>\nNo<\/a><\/td>\n<\/tr>\n
Certum<\/td>\ncrl.certum.pl<\/a><\/td>\nNo<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

* IPv6 Capability was checked via http:\/\/ipv6-test.com\/validate.php<\/a><\/p>\n

 <\/p>\n

OCSP repositories and IPv6<\/h6>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CA<\/strong><\/td>\nHost<\/strong><\/td>\nSupports V6<\/strong><\/td>\n<\/tr>\n
GlobalSign<\/span><\/td>\nocsp.globalsign.com<\/span><\/a><\/td>\nYes<\/span><\/td>\n<\/tr>\n
COMODO<\/td>\nocsp.comodoca.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
GoDaddy<\/td>\nocsp.godaddy.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
DigiCert<\/td>\nocsp.digicert.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
StartCom<\/td>\nocsp.startssl.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
TrustCenter<\/td>\nocsp.tcuniversal-I.trustcenter.de<\/a><\/td>\nNo<\/td>\n<\/tr>\n
TrustWave<\/td>\nocsp.trustwave.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
Enstrust<\/td>\nocsp.entrust.net<\/a><\/td>\nNo<\/td>\n<\/tr>\n
Symantec\/GeoTrust<\/td>\nocsp.geotrust.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
Symantec\/VeriSign<\/td>\nocsp.verisign.com<\/a><\/td>\nNo<\/td>\n<\/tr>\n
CyberTrust<\/td>\nsureseries-ocsp.cybertrust.ne.jp<\/a><\/td>\nNo<\/td>\n<\/tr>\n
Certum<\/td>\nocsp.certum.pl<\/a><\/td>\nNo<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

* IPv6 Capability was checked via\u00a0http:\/\/ipv6-test.com\/validate.php<\/a><\/p>\n

 <\/p>\n

CRL Size<\/h6>\n\n\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CA<\/strong><\/td>\nCRL<\/strong><\/td>\nSize<\/strong><\/td>\n# Entries<\/strong><\/td>\n<\/tr>\n
Certum<\/span><\/td>\nhttp:\/\/crl.certum.pl\/evca.crl<\/span><\/td>\n862<\/span><\/td>\n7<\/span><\/td>\n<\/tr>\n
Symantec\/Geotrust<\/span><\/td>\nhttp:\/\/EVSSL-crl.geotrust.com\/crls\/gtextvalca.crl<\/span><\/td>\n720<\/span><\/td>\n12<\/span><\/td>\n<\/tr>\n
Cybertrust<\/span><\/td>\nhttp:\/\/sureseries-crl.cybertrust.ne.jp\/SureServer\/2021_ev\/cdp.crl<\/span><\/td>\n1742<\/span><\/td>\n17<\/span><\/td>\n<\/tr>\n
GlobalSign<\/span><\/td>\nhttp:\/\/crl.globalsign.com\/gs\/gsextendvalg2.crl<\/span><\/td>\n1114<\/span><\/td>\n18<\/span><\/td>\n<\/tr>\n
TrustWave<\/span><\/td>\nhttp:\/\/crl.securetrust.com\/STCA.crl<\/span><\/td>\n2158<\/span><\/td>\n65<\/span><\/td>\n<\/tr>\n
StartSSL<\/td>\nhttp:\/\/crl.startssl.com\/crt4-crl.crl<\/td>\n2339<\/td>\n90<\/td>\n<\/tr>\n
DigiCert<\/td>\nhttp:\/\/crl3.digicert.com\/evca1-g1.crl<\/td>\n5393<\/td>\n100<\/td>\n<\/tr>\n
GoDaddy<\/td>\nhttp:\/\/crl.godaddy.com\/gds3-37.crl<\/td>\n6848<\/td>\n153<\/td>\n<\/tr>\n
Comodo<\/td>\nhttp:\/\/crl.comodoca.com\/COMODOExtendedValidationSecureServerCA.crl<\/td>\n12959<\/td>\n351<\/td>\n<\/tr>\n
TrustCenter<\/td>\nhttp:\/\/crl.ix.tcclass3.tcuniversal-i.trustcenter.de\/crl\/v2\/tc_class3_L1_CA_IX.crl<\/td>\n16138<\/td>\n407<\/td>\n<\/tr>\n
Entrust<\/td>\nhttp:\/\/crl.entrust.net\/level1e.crl<\/td>\n40995<\/td>\n1005<\/td>\n<\/tr>\n
Symantec\/VeriSign<\/td>\nhttp:\/\/EVIntl-crl.verisign.com\/EVIntl2006.crl<\/td>\n207922<\/td>\n5972<\/td>\n<\/tr>\n
* CRL count was determined using “curl url>crl & openssl crl -in crl -inform der -text | grep -c “Serial”<\/td>\n<\/tr>\n
* Size was determined using the Content-Length header, “curl –verbose –url *”<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

OCSP response Size<\/h6>\n\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CA<\/strong><\/td>\nHost<\/strong><\/td>\nSize<\/strong><\/td>\n<\/tr>\n
Comodo<\/span><\/td>\nocsp.comodoca.com<\/span><\/td>\n471<\/span><\/td>\n<\/tr>\n
Digicert<\/span><\/td>\nocsp.digicert.com<\/span><\/td>\n471<\/span><\/td>\n<\/tr>\n
GlobalSign<\/td>\nocsp2.globalsign.com<\/td>\n1491<\/td>\n<\/tr>\n
CyberTrust<\/td>\nsureseries-ocsp.cybertrust.ne.jp<\/td>\n1588<\/td>\n<\/tr>\n
StartSSL<\/td>\nocsp.startssl.com<\/td>\n1596<\/td>\n<\/tr>\n
Symantec\/Verisign<\/td>\nocsp.verisign.com<\/td>\n1739<\/td>\n<\/tr>\n
GoDaddy<\/td>\nocsp.godaddy.com<\/td>\n1923<\/td>\n<\/tr>\n
Entrust<\/td>\nocsp.entrust.net<\/td>\n1939<\/td>\n<\/tr>\n
Certum<\/td>\nocsp.certum.pl<\/a><\/td>\n2113<\/td>\n<\/tr>\n
Trustwave<\/td>\nocsp.trustwave.com<\/td>\n2519<\/td>\n<\/tr>\n
TrustCenter<\/td>\nocsp.tcuniversal-I.trustcenter.de<\/td>\n3135<\/td>\n<\/tr>\n
Symantec\/Geotrust<\/td>\nocsp.geotrust.com<\/td>\n3346<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

* Size was determined using the Content-Length header, “curl –verbose –url *”<\/p>\n

 <\/p>\n

OCSP Response Performance<\/h6>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CA<\/strong><\/td>\nHost<\/strong><\/td>\nAverage (ms)<\/strong><\/td>\n<\/tr>\n
GlobalSign<\/span><\/td>\nocsp2.globalsign.com<\/span><\/td>\n\n

95<\/span><\/p>\n<\/td>\n<\/tr>\n

DigiCert<\/span><\/td>\nocsp.digicert.com<\/span><\/td>\n\n

156<\/span><\/p>\n<\/td>\n<\/tr>\n

GoDaddy<\/span><\/td>\nocsp.godaddy.com<\/span><\/td>\n\n

163<\/span><\/p>\n<\/td>\n<\/tr>\n

COMODO<\/td>\nocsp.comodoca.com<\/td>\n\n

202<\/p>\n<\/td>\n<\/tr>\n

StartCom<\/td>\nocsp.startssl.com<\/td>\n\n

280<\/p>\n<\/td>\n<\/tr>\n

Enstrust<\/td>\nocsp.entrust.net<\/td>\n\n

293<\/p>\n<\/td>\n<\/tr>\n

Symantec\/GeoTrust<\/td>\nocsp.geotrust.com<\/td>\n\n

293<\/p>\n<\/td>\n<\/tr>\n

Symantec\/VeriSign<\/td>\nocsp.verisign.com<\/td>\n\n

295<\/p>\n<\/td>\n<\/tr>\n

TrustWave<\/td>\nocsp.trustwave.com<\/td>\n\n

297<\/p>\n<\/td>\n<\/tr>\n

TrustCenter<\/td>\nocsp.tcuniversal-I.trustcenter.de<\/td>\n\n

389<\/p>\n<\/td>\n<\/tr>\n

CyberTrust<\/td>\nsureseries-ocsp.cybertrust.ne.jp<\/td>\n\n

421<\/p>\n<\/td>\n<\/tr>\n

Certum<\/td>\nocsp.certum.pl<\/td>\n\n

568<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
* Measuring with Monitis<\/a>\u00a0points in\u00a0US-MID, US-EST-US-WST, Canada, Denmark, Netherlands, Germany, Spain, UK, Sweden, China, Austrailia, Signapore, Japan were used.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

CRL Repository Performance<\/h6>\n\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CA<\/td>\nHost<\/td>\nAverage (ms)<\/td>\n<\/tr>\n
GlobalSign<\/span><\/td>\ncrl.globalsign.com<\/span><\/td>\n101<\/span><\/td>\n<\/tr>\n
DigiCert<\/span><\/td>\ncrl3.digicert.com<\/span><\/td>\n102<\/span><\/td>\n<\/tr>\n
Entrust<\/span><\/td>\ncrl.entrust.net<\/span><\/td>\n120<\/span><\/td>\n<\/tr>\n
Comodo<\/td>\ncrl.comodoca.com<\/td>\n178<\/td>\n<\/tr>\n
GoDaddy<\/td>\ncrl.godaddy.com<\/td>\n186<\/td>\n<\/tr>\n
StartCom<\/td>\ncrl.startssl.com<\/td>\n267<\/td>\n<\/tr>\n
TrustWave<\/td>\ncrl.securetrust.com<\/td>\n272<\/td>\n<\/tr>\n
Symantec\/GeoTrust<\/td>\nEVSSL-crl.geotrust.com<\/td>\n298<\/td>\n<\/tr>\n
Symantec\/Verisign<\/td>\nEVIntl-crl.verisign.com<\/td>\n298<\/td>\n<\/tr>\n
TrustCenter<\/td>\ncrl.ix.tcclass3.tcuniversal-i.trustcenter.de<\/td>\n371<\/td>\n<\/tr>\n
Certum<\/td>\ncrl.certum.pl<\/td>\n426<\/td>\n<\/tr>\n
CyberTrust<\/td>\nsureseries-crl.cybertrust.ne.jp<\/td>\n454<\/td>\n<\/tr>\n
* Measuring with Monitis<\/a>\u00a0points in\u00a0US-MID, US-EST-US-WST, Canada, Denmark, Netherlands, Germany, Spain, UK, Sweden, China, Austrailia, Signapore, Japan were used.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

So the last few weeks I have spent a reasonable amount of time looking at performance and networking related problems associated with revocation repositories. I still have some additional work to do but I figured I would capture some of my findings in a quick post. CRL repositories and IPv6 CA Host Supports V6 GlobalSign […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[3],"tags":[34,25,171,24,19],"class_list":["post-147","post","type-post","status-publish","format-standard","hentry","category-security","tag-crl","tag-ocsp","tag-performance","tag-revocation","tag-x509"],"_links":{"self":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=147"}],"version-history":[{"count":0,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/147\/revisions"}],"wp:attachment":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}