1007275 - Need more control of OCSP failures

Status: RESOLVED WONTFIX

(Core :: Security, enhancement)

Description

[Marc Auslander]

The only behaviors for OCSP (Online Certificate Status Protocol) are

1.  Fail all sites that are not found (described as connection failure)
2.  Accept all sites that are not found

Thus if you choose to visit an OCSP failure site you must disable the check completely and then re-enable it afterwards.

A better way would be to provide an exception pop-up as is done with other certificate issues with choices of accept for this session, except always, or reject.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Asking users to make more decisions based on limited information and technologies they may not be familiar with is not a direction we want to go in. Instead of relying on inherently flawed mechanisms like OCSP, we're developing new technologies (e.g. oneCRL, certificate transparency) that will protect users without asking them to make these kinds of decisions.