The Challenge of Revocation in PKI
Public Key Infrastructure relies on the assumption that a certificate remains trustworthy until its expiration date. However, security incidents such as private key compromises or administrative errors require a mechanism to invalidate credentials prematurely. This necessity gives rise to the mechanisms of Certificate Revocation Lists (CRL) and the Online Certificate Status Protocol (OCSP).
Certificate Revocation Lists
A CRL is a signed file containing a list of serial numbers for certificates that have been revoked by a Certificate Authority (CA) before their scheduled expiration. Clients download these lists to check if a presented certificate appears in the database. While simple in concept, CRLs suffer from significant scaling issues. As the number of revoked certificates grows, the file size increases, leading to higher latency and bandwidth consumption for clients that must fetch and parse the entire list.
Online Certificate Status Protocol
To address the inefficiencies of large CRL files, the Online Certificate Status Protocol (OCSP) was developed. Instead of downloading an entire list, a client sends a specific request to an OCSP responder, querying the status of a single certificate. The responder returns a signed response indicating whether the certificate is 'good', 'revoked', or 'unknown'.
Real-time updates: OCSP provides more granular and timely status checks compared to periodic CRL updates.
Privacy trade-offs: Traditional OCSP requests reveal to the CA exactly which sites a user is visiting, prompting the use of OCSP stapling.
Performance overhead: Making an external network call during the TLS handshake introduces latency, often mitigated by caching responses.
OCSP Stapling: The Modern Standard
OCSP stapling shifts the burden of querying the CA from the client to the server. The server periodically fetches a signed OCSP response from the CA and 'staples' it to the TLS handshake. When a client connects, it receives the certificate and the proof of validity simultaneously. This eliminates the need for the client to contact the CA, preserving user privacy and reducing connection latency.
Reliable revocation remains a difficult problem in distributed systems. While stapling resolves most performance and privacy concerns, it requires robust server-side support to ensure the cached proof is always current. Engineers must balance the desire for immediate security revocation against the reality of network reliability and client-side performance.