Private CDN OCSP Response Caching for Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current approaches for using content delivery networks (CDNs) to distribute Online Certificate Status Protocol (OCSP) responses face issues such as stale responses due to caching, increased infrastructure demands, and slower response times for recently-issued certificates, leading to latency and performance degradation.
Innovation Solution
Implementing a private content delivery network (PCDN) that proactively caches OCSP responses and generates cache keys, allowing for faster retrieval and reducing the need for relying parties to fetch updated responses from the origin server, thereby minimizing latency and infrastructure load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a CDN caches OCSP responses ahead of time, then response delivery speed is improved, but the responses may become stale and incorrect when certificates are revoked
Solution Approach 1:
The system performs preliminary actions by having the CDN proactively request and cache OCSP responses before they are needed by relying parties. The CDN periodically fetches responses from the CA and stores them locally, so when a relying party needs validation, the response is already available in the CDN cache, eliminating the need for real-time requests to the CA.
2Reliability
If the CDN removes expired responses from cache, then response freshness is improved, but response times degrade as relying parties must retrieve updated responses from the origin server
Solution Approach 1:
The CDN proactively refreshes OCSP responses in the cache before they expire by periodically requesting updated responses from the CA. This ensures that when relying parties request validation, fresh responses are already available in the CDN cache, avoiding the need for them to wait for origin server responses.
3Reliability
If the CDN redirects requests for new certificates to the issuing CA, then certificate validation accuracy is improved, but infrastructure demands on the CA increase and response times slow down
Solution Approach 1:
The CDN acts as an intermediary between relying parties and the CA for new certificate requests. When a relying party needs to validate a newly issued certificate, the request is directed to the CDN instead of directly to the CA. The CDN then handles the validation using cached responses or generates appropriate error messages, reducing the load on the CA while maintaining validation functionality.
Data Source
AI summary
Techniques are disclosed for accelerating online certificate status protocol (OCSP) response distribution to relying parties using a content delivery network (CDN). A certificate authority generates updated OCSP responses for OCSP responses cached in the CDN that are about to expire. In addition, the certificate authority pre-generates cache keys in place of CDNs generating the keys. The certificate authority sends the OCSP responses and the cache keys in one transaction, and the CDN, in turn, serves requests for the OCSP responses using the cache keys. For new certificates, a private CDN is pre-populated with an OCSP response for a certificate concurrent with that certificate being issued. Doing so effectively uses the PCDN as an origin server for OCSP responses, reducing CA infrastructure needs.