@Everyone,
This statement
Not really. One problem is that when the servers are unresponsive yet the webserver for some reason might still want to address them, on systems with many websites an Nginx reload or restart will hang and eventually run into a timeout. In other words: The web server might not restart. This was a known issue once when some nameservers stopped resolving their OCSP server domain names.
might be a bit confusing.
First of all, OCSP related issues concern all web servers, at least in theory and - in most cases - also in practice.
Plesk essentially comes with two flavors of web servers : Apache and stand-alone Nginx.
Nginx can be a stand-alone web server OR a reverse proxy (in front of the web server) : in most usage scenarios, Nginx is a reverse proxy.
The current OCSP issue is - factually - limited to Nginx error notifications.
This simply means that Nginx, as a stand-alone Nginx instance OR a reverse proxy, is giving some notifications.
If Nginx is a reverse proxy, then the part "the web server might not restart" is not correct : Nginx (as reverse proxy) will restart!
If Nginx is a stand-alone web server, then Nginx (as stand-alone web server) will - often - restart : only in highly exceptional cases, restart will fail.
If Apache is the web server ......... well, then failures to restart are to be expected.
In summary, it is important to know whether you use Nginx as a reverse proxy or a stand-alone web server.
A clear distinction should be made between the two of them, since the likelihood on and amplitude of (potential) OCSP related issues are completely different between the stand-alone Nginx and the Nginx as a reverse proxy.
This statement
All in all I think it is safe to call turning of OCSP service is a stupid decision by Let's Encrypt. And it foreshadows a path we don't want to see: That sooner or later the whole free SSL project will stop, forcing hundreds of millions of users to buy overpriced certificates from commercial vendors again.
is both right and wrong.
Let's Encrypt made an excellent decision, when (only) looking at the security aspect of OCSP Stapling, since the CA (Certificate Authority) can and WILL gather all kinds of information that you do not want to share with the CA.
Moreover, Let's Encrypt does not mention the - relevant - fact that any CA will become more and more a SPOF (Single Point of Failure) in a system that should increase (and not reduce) security : any hack of any CA will expose lots of information (and this has happened before).
People should make a trade-off when deciding to turn OCSP Stapling on OR off : security will increase by the OCSP mechanism itself, but security will also decrease by allowing the CA to gather information that should be private.
What makes Let's Encrypt's decision excellent?
Well, the simple fact that they do not want to be legally obliged to store specific information ....... with that kind of motive, one could really not object to a decision that involves shutdown of OCSP Stapling.
What makes Let's Encrypt decision a bit less ideal?
Well, if OCSP Stapling is replaced by CRLs (at Let's Encrypt) and other mechanisms (from other companies) .......... then there is uncertainty about what the new industry standard is going to be AND there is space for specific companies to enforce their method as the industry standard.
It is not going to happen that the free SSL projects will stop.
It is also barely relevant.
Nevertheless, it will become relevant that other companies will offer free or cheap SSL certificates.
And there lies the actual problem.
Consider Google ..... offering alternatives to Let's Encrypt (free) SSL certificates would leave us with Google as the CA - without doubt, all data will be used for tracking purposes, which is the core business of companies like Google.
The decision of Let's Encrypt is excellent and honest, but it also will result in space for other (less honest) companies to go into the SSL certificate business.
In my humble opinion, we should not worry about the decision of Let's Encrypt, but we should about the consequences of that decision.
No, it is not very likely that free SSL certificates will become a "thing of the past".
Yes, it is very likely that commercial motives will enter the domain of both paid-for and free SSL certificates - there will always be an incentive to earn money with data gathered, if that data can be gathered - for instance, by becoming a CA that is legally obliged to store specific data.
Nevertheless, even though there might be companies wanting to leap into the market that is partially abandoned by Let's Encrypt, it is still safe to say that all mechanisms (like CRLs) provided by Let's Encrypt are better than the alternatives - Let's Encrypt simply is a more honest project / company.
All of the above is just some food for thought!
Kind regards ...
Facebook
Twitter
