OCSP stapling support can be used to optimize TLS connections

[vincentkam]

Hello :)

Are there any plans to expand support for OCSP stapling? Using WireShark, I see that the status_request TLS extension is only set on MacOS on .Net Core >= 2.0 after setting checkCertificateRevocation to true when calling SslStream.AuthenticateAsClient. On Linux and Windows, there appears to be no stapling support, even though my loose understanding is that both OpenSSL and Secure Channel support stapling.

The reason I'm asking for expanded OCSP stapling support is that we would like the MongoDB .NET/C# driver to have support for stapled OCSP on Linux and Windows (our goal is to have all MongoDB drivers fully support OCSP).

[Dotnet-GitSync-Bot]

I couldn't add an area label to this Issue.

Checkout this page to find out which area owner to ping, or please add exactly one area label to help train me in the future.

[karelz]

@bartonjs this looks like something crypto layer should support first. Or do we need to do something special in SslStream?

[bartonjs]

@karelz Both 😄

For Windows, it's entirely going to be SslStream. Presumably there's just a flag or option you set for SChannel and it does it.

For Linux, things are more involved:

• We'd need to expose API (shared source or public) to either get a current OCSP response from the cache or build the request and get the response (and cache it if appropriate), which also tells you the expiration time of the response.
  • It's not just "here's the stuff I used for determining revocation" since it needs to be OCSP-only, and not use CRL.
• SslStream would need to add that to the SSL* or SSL_CTX* or wherever it goes.

I'd be OK with doing the "so, give me OCSP data to staple" as internal to the Linux PAL for SslStream right now; and if there's time and demand we can make a public version of it.

[ayende]

Would like to add that this would be a very welcome feature for us as well.
CRL usage as it current stands leave us with either disable it or suffer random downtime.

https://ayende.com/blog/192261-B/the-failure-of-a-computer-you-didnt-even-know-existed?

[adityamandaleeka]

@jeffhandley Just curious, should this still be at priority 3 given that we have a partner ask for it?

[jeffhandley]

@bartonjs Is there anything further to do on this issue now that #67011 and #69833 have been merged?

[bartonjs]

There's still a tweak and test for Windows, but Linux is done.

[bartonjs]

This work is believed to be complete, across #67011, #69833, and #71570.

If you're reading this issue, using .NET 7 RC1 or newer, and disagree... please open a new issue with details 😄