Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt caches around 100k OCSP requests every second

news.ycombinator.com

Post reply on HN
Print view View original

1–2 of 2 posts

Let's Encrypt caches around 100k OCSP requests every second

#1

Post by dfern »

"Since Let’s Encrypt serves 300 million domains, we cache around 100,000 OCSP requests every second. Historically, Let’s Encrypt could cache about 6% of this traffic on its own. But were we to experience traffic much higher than that, we’d risk Let’s Encrypt falling over. Not an ideal situation for us, or the Internet."

https://www.abetterinternet.org/documents/2022-ISRG-Annual-Report.pdf

Re: Let's Encrypt caches around 100k OCSP requests every second

#2

Post by LinuxBender »

I am not ok with this. People want DoH/DoT because their ISP can monitor their browsing habbits and yet it is acceptable to leak every site one visits to a centralized OCSP responder? I do not believe so. I realize this is not the exact same threat model rather just a piece of it not to mention protecting from ISP's also requires ESNI which is not supported yet. Regardless this is stagnation of technology.

The solution? Require all browsers and anything that acts like a browser to support OCSP stapling [1] and have an OCSP stapling flag day to encourage all website operators to enable OCSP stapling. Most load balancers and web servers support OCSP stapling and the most popular browsers already support it.

Pros and Cons linked below.

[1] - https://knowledge.digicert.com/quovadis/ssl-certificates/ssl...

Post reply on HN