Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

OCSP stapling adds two more signatures to the TLS handshake. Bad enough with RSA keys but post-quantum signatures are much larger. OCSP stapling was always a band-aid.

If the server must automatically reach out to retrieve a new OCSP response for stapling every 7 days, why not just get automatically a whole new certificate which is simpler and results in a lots less data on the wire for every TLS connection?



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: