OCSP Stapling in TLS Handshake for Certificate Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Browser applications experience substantial delays in receiving Online Certificate Status Protocol (OCSP) responses due to the need for separate network transactions with the Certificate Authority (CA), leading to substandard user experiences.
Innovation Solution
A method and system that generate a server certificate and its proof of validity during a TLS handshake, eliminating the need for the browser to verify the certificate with the CA as a separate network transaction by providing the proof of validity within the TLS handshake process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the browser application requests an OCSP response from the certificate authority (CA) to verify certificate validity, then the certificate verification is ensured, but substantial delays occur in receiving the OCSP response
Solution Approach 1:
The OCSP response is generated and included in the TLS certificate bundle before the browser needs to verify it. The network traffic manager creates the OCSP response as part of the certificate generation process, so it is already available when the browser performs verification, eliminating the need for a separate network request to the CA.
Solution Approach 2:
The network traffic manager acts as an intermediary between the certificate authority and the browser application. It generates certificates with embedded OCSP responses and serves them to clients, mediating the verification process and eliminating direct communication between browsers and CAs for OCSP requests.
2Reliability
If the browser application communicates with the CA to obtain OCSP response, then the certificate status is verified, but network delays occur in the ISP network, routers, and Internet between user and CA
Solution Approach 1:
The OCSP response is extracted from the separate network communication process and embedded directly into the TLS certificate bundle. This removes the need for additional network communication between the browser and CA, as the verification data is now locally available in the certificate itself.
Solution Approach 2:
The OCSP response is merged with the TLS certificate bundle, combining what were previously separate entities (certificate and status verification data) into a single transmitted object. This eliminates the need for separate network transactions.
3Reliability
If a separate network transaction is used for OCSP verification, then the certificate validity is confirmed, but the protocol efficiency is reduced and user experience deteriorates
Solution Approach 1:
The OCSP response is prepared in advance as part of the certificate generation process, so no additional time is spent on verification network transactions. The browser can immediately verify certificate validity using the pre-generated response included in the certificate bundle.
Data Source
AI summary
Methods, non-transitory computer readable media, and network traffic manager apparatus that assists with adding an online certificate status protocol (OCSP) in conjunction with generated certificates includes receiving a client request to access a website via a TLS connection. A server certificate is generated for the requested website. Next, a proof of validity is generated for the generated server certificate. The generated server certificate and the generated proof of validity of the generated server certificate are provided to a client during a TLS handshake period.