Skip to content

Use HTTP 1.0 for OCSP responses#711

Open
TheComputerGuy96 wants to merge 1 commit intoopen-eid:masterfrom
TheComputerGuy96:legacy-ocsp
Open

Use HTTP 1.0 for OCSP responses#711
TheComputerGuy96 wants to merge 1 commit intoopen-eid:masterfrom
TheComputerGuy96:legacy-ocsp

Conversation

@TheComputerGuy96
Copy link

For some reason, the nsc.vrm.lt's OCSP responder responds really slowly (over 2 minutes) in HTTP 1.1 mode (so use the legacy 1.0 protocol for OCSP responses)

Signed-off-by: Aida Jonikienė tcg96nougat@gmail.com

@metsma
Copy link
Contributor

metsma commented Feb 2, 2026

Is it same with openssl ocsp command?
openssl ocsp -url http://url -issuer issuer.pem -cert cert.pem -CAfile CA.pem -req_text

@TheComputerGuy96
Copy link
Author

Is it same with openssl ocsp command?

@metsma openssl ocsp seems to use HTTP 1.0 behind the scenes (so of course it isn't affected)

@metsma
Copy link
Contributor

metsma commented Feb 2, 2026

You are correct.
https://github.com/openssl/openssl/blob/master/crypto/http/http_client.c#L221

Maybe change the Connect parameter to something like std::string_view version = "1.1" ?

For some reason, the nsc.vrm.lt's OCSP responder responds really
slowly (over 2 minutes) in HTTP 1.1 mode (so use the legacy 1.0
protocol for OCSP responses)

Signed-off-by: Aida Jonikienė <tcg96nougat@gmail.com>
@TheComputerGuy96
Copy link
Author

Maybe change the Connect parameter to something like std::string_view version = "1.1" ?

@metsma Done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants