CAS-003 · Question #857
A product owner is working with a security engineer to improve the security surrounding certificate revocation, which is important for the clients using a web application. The organization is…
The correct answer is C. Stapling should be used with OCSP. CRLs (Certificate Revocation Lists) suffer from publishing delays and require clients to download potentially large lists. OCSP (Online Certificate Status Protocol) solves the delay problem by providing real-time per-certificate revocation lookups, but standard OCSP introduces…
Question
A product owner is working with a security engineer to improve the security surrounding certificate revocation, which is important for the clients using a web application. The organization is currently using a CRL configuration to manage revocation, but it is looking for a solution that addresses the reporting delays associated with CRLs. The security engineer recommends OCSP, but the product owner is concerned about the overhead associated with its use. Which of the following would the security engineer MOST likely suggest to address the product owner’s concerns?
Options
- AKey escrow can be used on the WAF
- BS/MIME can be used in lieu of OCSP
- CStapling should be used with OCSP
- DThe organization should use wildcard certificates.
How the community answered
(29 responses)- A7% (2)
- B14% (4)
- C76% (22)
- D3% (1)
Explanation
CRLs (Certificate Revocation Lists) suffer from publishing delays and require clients to download potentially large lists. OCSP (Online Certificate Status Protocol) solves the delay problem by providing real-time per-certificate revocation lookups, but standard OCSP introduces overhead: every connecting client must independently query the CA's OCSP responder, adding latency and placing load on the CA infrastructure. OCSP Stapling (Answer C) resolves this overhead concern by shifting the OCSP query responsibility to the web server itself. The server periodically fetches a signed, time-stamped OCSP response from the CA and 'staples' it directly into the TLS handshake. Clients receive the revocation status without making a separate network request to the OCSP responder, reducing latency, decreasing CA infrastructure load, and preserving client privacy. This is exactly the trade-off the security engineer needs to address the product owner's concern about OCSP overhead.
Topics
Community Discussion
No community discussion yet for this question.