OCSP response times don’t matter that much once OCSP stapling is supported everywhere. Unfortunately, we didn’t have time to implement it for PHP’s streams in time for PHP 7.
indeed true.. just curious how LE OCSP performance stacks up with other CAs for non-stapled responses. i.e. pretty sure there's quite alot of Apache 2.2.x based https serving servers out there too.
Every server supporting it makes it not only faster for its users but also for all other LE sites, because the LE servers have less load then. Can’t give you any stats.
indeed it does… guess it’s important in LE client deployment where you alter server configs, that OCSP stapling is configured where available
hmmm if it’s that important, not sure if additional automated checks for working OCSP on LE deployed and auto reconfigured web servers would be a good idea ?
interesting finding from http://uptime.netcraft.com/perf/reports/performance/OCSP?orderby=avg_total and looking an individual CA’s ocsp stats pages the top 5 commercial CA’s some use Akamai as well but the faster Akamai ones are reporting server signatures as Nginx while slower Akamai ones are reporting Apache 2.2/Debian
As of today our OCSP responder answers in 41ms average, 47ms median.
We definitely care a lot about performance characteristics of our OCSP responder, and we plan to continue monitoring it in the long run as load increases.
Of course, we also strongly encourage everyone who can enable OCSP Stapling to do so. It's a win on multiple levels!
