What is the relationship between the revoking list and OCSP Stapling?

Wow! I can recreate and confirm. This helps, and now I believe I can explain after doing some digging.

I was calculating the expiry as 7 days from the "This Update" timestamp, because several RFCs and software projects mention "7 days".

After digging around a lot of Mozilla docs, wow - I was wrong. In several parts of their documentation and security information, Mozilla explicitly notes they cache the OCSP response for 10 days in accordance with the current policy defined in the CA/B Forum Baseline Requirements. I double checked the current Baseline Requirements, and confirmed. Most projects and systems are implementing a maximum cache duration of 7 days by choice, not by requirement – Mozilla has instead decided to implement the maximum cache period allowed by the Baseline Requirements of 10 days.

I tried toggling several of mozilla's security and ocsp settings in the advanced config section (about:config) but nothing influenced this behavior. There is a setting I hoped might influence this behavior, security.pki.cert_short_lifetime_in_days which is set to 10 days, but that does not influence the OCSP staple - just certificates near their own expiry.

see: CA/Revocation Checking in Firefox - MozillaWiki

Tagging @JamesLE as he was involved in this topic.

6 Likes