Google Trust Services: OCSP responses not published in a timely manner
Google Trust Services (GTS) reported that, during a review related to fixes in Bug 1758372, an engineer identified that its OCSP responders could set the `Cache-Control` HTTP `max-age` directive to a value that potentially prevents updated OCSP responses from being published in a timely manner after transitions from “good” or “revoked” to another status. GTS stated this issue did not result in misissuance, and that it may have resulted in delayed publication of OCSP status information following some revocations. In response, GTS updated its OCSP responder software to reduce the `max-age` value (including reducing it from 24 hours down through 6 hours, 5 hours, and then 4 hours) and made an edge cache configuration change to limit caching time as an additional control. GTS also completed a deeper evaluation of its OCSP responders against applicable requirements and reported finding no non-conformances, while identifying opportunities to improve protocol support for suggested behaviors to be included in a future release after retiring its legacy OCSP responder. GTS requested consideration to close the bug after completing the evaluation and deployments, and Mozilla indicated it would review for closure on 29-June-2022. The bug is marked RESOLVED with resolution FIXED.
- GTS identified an OCSP caching behavior issue while reviewing prior OCSP fixes.
- GTS began reducing the OCSP `Cache-Control` `max-age` value in its OCSP responder software.
- GTS completed the deployment of OCSP and edge cache configuration updates globally.
- GTS completed a deeper evaluation of OCSP responders and requested closure.
- Google representative — GTS reported that its OCSP responders’ `Cache-Control: max-age` setting in certain cases could prevent updated OCSP responses from being published promptly after status transitions, and said it would post a full report.
- Google representative — GTS provided a detailed timeline and described that the issue may have caused delayed publication of OCSP status after some revocations, without misissuance.
- Google representative — GTS said it was continuing remediation and deploying a change to reduce `max-age` to 18000 seconds (5 hours), with further reductions planned after observing load impact.
- Google representative — GTS stated it would further reduce `max-age` to 14400 seconds (4 hours) in a deployment later that week and continue monitoring.
- Google representative — GTS said the deployment to 14400 seconds (4 hours) would complete and that it would evaluate whether further reduction was appropriate.
- Google representative — GTS reported completing a deeper evaluation with no non-conformances, noted additional protocol-support opportunities for a future release, and requested consideration to close the bug.
- Mozilla representative — Mozilla said it would review the bug for closure on Wed 29-June-2022.