87654 - OCSP causes Cert Manager to become dreadfully slow

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[Javier Delgadillo]

On NT, I've got a profile with lots of certs that use the AIA extension (this is
the extensions that specifies the URL for OCSP).  When I try to open the
Certficate Manager, loading it takes a *very* long time.  If I then turn off
OCSP,  Cert Manager loads at a normal speed once again.

We need to figure out how to prevent the dreaded slow-down we're currently
seeing with OCSP enabled.

Comment 1

[Bob Lord]

Setting target to 2.0 in the hopes that we can at least identify the problem or
a workaround before we ship.

Comment 2

[Bob Lord]

Target 2.0 -> 2.1

Comment 3

[Javier Delgadillo]

Failure->P1

Comment 4

[Stephane Saux]

P1

Comment 5

[Javier Delgadillo]

I started playing with this, and it appears that the overhead of OCSP is big
enough to cause loading of the cert manager to become dreadfully slow.

So I propose the following:
1) When getting the purposes, always turn off OCSP.  This gives us the advantage
of knowing what the certificate would be good for if OCSP were successful and
reducing the number of OCSP operations required to load the certificate manager.

2) If OCSP is enabled then, then "Verified" column gets some graphic or text in
essence saying "Shall I go ahead with the OCSP operation?" and if the user
clicks on the text/graphic then we go ahead with the OCSP operation.  

This is bad because it can cause problem evenif the OCSP responder is up and
running successfully.  :(

Thoughts anyone?

Comment 6

[John Unruh]

Mass assigning QA to ckritzer.

Comment 7

[Bob Lord]

Javi's proposal is to delay OCSP verification until the user manually initiates
it, which would be after the window was painted. 
To close the loop, the Verified column could display "true", "false", and "true,
pending OCSP".  We'd then need to add a "Validate OCSP now" button. That would
turn "true, pending OCSP" into either "true" or "false".

Now, what happens if you hit that button and you get "false".  You're going to
want to know what happened by looking at the Cert Viewer. I filed bug 93703 to
cover those thoughts.

Javi, this bug report should just cover the initial fix (which I'm OK with). 
Please open a new bug which contains your ideas on the new buttons.  We can put
those into a future release.

Comment 8

[Javier Delgadillo]

Attachment: Patch that disables OCSP when in Cert Manager.

Comment 9

[David P. Drinan]

r=ddrinan.

Comment 10

[Christopher Blizzard (:blizzard)]

sr=blizzard

Comment 11

[Javier Delgadillo]

Patch checked in.

Comment 12

[ckritzer (gone)]

Javi, are you still seeing this?  I don't have a ton of certs @ home, so I'm 
not seeing a big slowdown on:
Win2k  2001-08-10-10-trunk Commercial
MacOSX 2001-08-10-05-trunk Commercial

 - I'll verify when I get in on Monday as well, but if you could take a quick 
look, that'd be great.

Thanks - Kritzer

Comment 13

[Stephane Saux]

chris,
If you don't see a big slowdown that's because Javi's fixed the bug.
It used to be that if you used the third OCSP option (specify the signer and
url) to some inexistant value the application would basically be so slow as to
be unusable. Not seeing this is verifying the bug.

Comment 14

[ckritzer (gone)]

Marking VERIFIED FIXED on:
- MacOS91 2001-08-21-04-trunk (commercial)
- MacOS_X 2001-08-21-05-trunk (commercial)
- LinRH62 2001-08-21-06-trunk (commercial)
- Win98SE 2001-08-21-11-trunk (commercial)


Not seeing any slowdowns.