User.js: Look into tweaking security.pki.cert_short_lifetime_in_days

[pyllyukko]

https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/

[Atavic]

pref("security.pki.cert_short_lifetime_in_days", 10);

The CA SHALL update information provided via an Online Certificate Status Protocol at least every four days.
OCSP responses from this service MUST have a maximum expiration time of ten days.

From PDF: https://cabforum.org/baseline-requirements-documents/
4.9.10. On‐line Revocation Checking Requirements

[nodiscc]

@Atavic what's your point?

[nodiscc]

As far as I understand, certificates with a lifetime of < 10 days are not checked for revocation because 10 days is the delay it takes for OCSP responders and CRLs to be notified of revocation.

Lowering this delay would result in pointless requests to OCSP servers and accompanying privacy issues, and degraded performance.

Short lived certificates are currently a best practice compared to other broken certificate revocation checking methods.

[Atavic]

@nodiscc I just followed the URL and answered the question. There's a link to the baseline requirements and I've read that.

10 days is the max, while 4 days is the min.

[nodiscc]

2 new prefs

+pref("security.OCSP.timeoutMilliseconds.soft", 2000);
+pref("security.OCSP.timeoutMilliseconds.hard", 10000);

landed in https://hg.mozilla.org/mozilla-central/rev/d0e27739f475 which make the OCSP timeout delay configurable.

In case we keep configuring the browser to require OCSP everywhere, and want to lower security.pki.cert_short_lifetime_in_days to _also_ query OCSP for short-lived certificates, tweaking the timeout may help in reducing breakage (increase the timeout).

The current problem is that OCSP responders are single points of failure. When the requested OCSP server is down, Firefox shows a (non-bypassable) error and any access to the site is prevented (sometimes happened to me).

[Atavic]

10 days is set to ease the CA servers bandwidth and nothing more.

EDIT - About OCSP checks:

They time out about 15% of the time, and take about 350ms even when they succeed.

Source

Globalsign: 375 ms

Source