1953550 - Disable OCSP fallback for in-program certificates that are not covered by CRLite when CRLite is in enforcement mode

Status: ASSIGNED

(Core :: Security: PSM, enhancement, P3)

Description

[John Schanck [:jschanck]]

There are a few situations where the user's CRLite data may not cover a certificate that chains to our root store, e.g.

1. the user has not yet downloaded CRLite filters, or
2. the user's CRLite filters are out-of-date, or
3. the certificate has been in CT for < 1 MMD interval.

If we're configured to enforce CRLite and tolerate OCSP soft failures, then it is reasonable to treat these as "CRLite soft failures" and skip OCSP fetching. Doing so will reduce the number of OCSP requests that we make for new profiles and profiles that have not been used recently.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1953550 - reduce the use of OCSP when CRLite is enforced. r=keeler