|
Introduction:
OCSP (Online Certificate Status Protocol) is an Internet Protocol (IP) used to determine the status of SSL certificate revocation status, specifically to X.509 certificates. The alternate option of checking the SSL certificate's revocation status is using the CRLs. OCSP uses the Port 80 (HTTP) for communications.
How OCSP works:
- Client Requests Status: When a user, such as a web browser, browses to a website with HTTPS (SSL/TLS), the browser checks and verifies the validity of an SSL/TLS certificate. It sends a request to an OCSP responder (a server managed by the certificate authority that issued the certificate).
- OCSP Responder Replies: The OCSP responder checks the certificate’s status (valid, revoked, or unknown) and sends a response to the client.
- Client: Based on the OCSP response, the client determines if the certificate is trusted or not, browsing the site normally or prompting the SSL warning as a result of the SSL certificate being untrusted.
Overview of Let’s Encrypt intention to end OCSP service:
In a recent announcement from LetsEncrypt, they have informed of the intention to end the OCSP service support. The decision came after the Certification Authority Browser Forum (CA/Browser Forum) passed a ballot to make providing OCSP services optional for publicly trusted Cas.
Related URL:
https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls/
There is no exact timeline provided on the End of Support of the OCSP service, but it is believed to be happening in the next six to twelve months.
Implications of Ending OCSP Support:
- OCSP Stapling: Servers/devices will no longer be able to staple OCSP responses for Let’s Encrypt certificates once OCSP is phased out.
- Browser Handling: Since many browsers have already reduced their reliance on OCSP checks, this change is expected to have minimal impact on most users.
FortiWeb:
If the FortiWeb is configured with the OCSP stapling policy of a specific certificate issued by Let’sEncrypt, it is recommended to switch to the CRLs option.
Related documents:
Revoking certificates
https://www.fortinet.com/resources/cyberglossary/ocsp |
