Subject: [wpkops] Example of failure of Web PKI for popular web sites

From: Paul Hoffman <[email-masked]>
Date: Fri, 13 Dec 2013 09:16:27 -0800

Soundcloud is a very popular (legal) source of free music, especially popular in the independent music community. Some users have been told that everything should be done with TLS, so they give the URL as <https://soundcloud.com/>.

See <http://www.vpnc.org/Soundcloud-OCSP.png>. The screen shot is from Firefox; going to the URL in Chrome and Safari works fine. This has been happening for more than a day.

I'm not sure how we should be capturing failures of large, established sites in our documents, but they should be considered.

--Paul Hoffman

---

From: Rob Stradling <[email-masked]>
Date: Fri, 13 Dec 2013 21:46:10 +0000

Hi Paul.  Did you upgrade to Firefox 26 about a day ago, by any chance?

Firefox 26 is the first version of Firefox to support OCSP Stapling.

Some possibly relevant bugs:
https://bugzilla.mozilla.org/show_bug.cgi?id=928696
https://bugzilla.mozilla.org/show_bug.cgi?id=923887

I think the root of this problem is in Nginx's implementation of OCSP 
Stapling.

On 13/12/13 17:16, Paul Hoffman wrote:
> _______________________________________________
> wpkops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wpkops
>

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 13 Dec 2013 13:56:44 -0800

> Hi Paul.  Did you upgrade to Firefox 26 about a day ago, by any chance?

Why, certainly!

> I think the root of this problem is in Nginx's implementation of OCSP Stapling.

Could be. Having said that, this does not explain why Firefox 26 for Windows and Linux does not cause the same problem. :-)

--Paul Hoffman