Bulk OCSP Requests

Yes and no. RFC 6960 explicitly allows an OCSP request to include more than one certificate in the request list. Correspondingly, the response may contain more than one OCSPResponseStatus.

However, if I try to do this (sending multiple OCSP status requests in a single HTTP query to Let's Encrypts responder), I only get a single response for the first certificate in the request - the others are omitted. Reading through some information in the 'net, this seems to be rather common among OCSP responders - multiple responses seem to be rarely supported. So the answer for Let's Encrypt specifically seems to be "no, you can't.".

(I would guess that this has something to-do with the fact that OCSP responses are pre-signed and pre-cached, so allowing multiple certificates in a single request would kill pre-signing).

I'm not Let's Encrypt staff, so I can't give you a hard yes/no answer on that, but I can make some more-or-less educated guesses.

We should recall that OCSP is a very high throughput service (source). Let's Encrypt probably serves more OCSP responses than it issues certificates, so OCSP is optimized for throughput/speed.

Let's Encrypt uses the Akamai CDN for delivery of its OCSP responses. OCSP responses are cached as efficiently as possible, so I presume that most OCSP requests are directly answered by the CDN. Given the high capacity of a CDN, this should both give good availability and high throughput.

Considering this information, I believe that you can send a lot of OCSP requests in a short timeframe without worrying too much. To protect infrastructure, either Let's Encrypt or Akamai (or both) probably have rate-limiting to prevent abuse or DOS-style attacks - but I expect the limit to be in the magnitude of maybe a thousand requests/second (note that I haven't verified this, so I may be wrong).


Note that you can test pretty much all of this. Let's Encrypt allows for all kind of playtesting in their staging enviroment. The limits in staging are rather high, so using two dummy/throwaway/test domains you can obtain 50.000 test certificates in less than a week from staging. Let's Encrypt does offer OCSP for its staging certificates, same as for the production ones. Looking at the OCSP responder, it appears that staging OCSP uses the exact same Akamai configuration/responder as production.

But, given that you already have the certificates, you could probably also directly test in production, since you're only requesting OCSP - you could test just obtaining the OCSP responses on a test machine, without actually using the OCSP responses in production.

If you do manage to find out the limit at which you see something happening (Akamai refusing you, throttling etc) I think we would be interested to hear what you managed to achieve.

7 Likes