Mozilla will be experimenting with disabling OCSP checking<\/a> due to performance concerns. OCSP, or Online Certificate Status Protocol<\/a>, is one of the technical mechanisms used to check if a certificate has been revoked.<\/span><\/p>\n The change will be made in an upcoming version of Nightly<\/em><\/a> \u2013 a pre-release version of Firefox dedicated to testing new features. If telemetry data shows that it’s best to disable OCSP checking for DV and OV certificates because it reduces the total time of the handshake, it will be brought to the consumer release of Firefox.<\/p>\n This will bring Firefox to par with other major browsers, including Chrome and Safari, which<\/p>\n OCSP Stapling \u2013 where the server provides the OCSP response directly to the client \u2013 will not be affected. Firefox will also continue to fetch OCSP responses for EV (Extended Validation) certificates.<\/p>\n OCSP has long been criticized as being broken. Because of the operational challenges of deploying the service at a global scale, OCSP often ends up in a situation where it \u201csoft-fails\u201d \u2013 meaning in the case that an OCSP check isn\u2019t completed (because the server is down or the connection times out) the certificate is assumed to be valid. With soft-fail, it\u2019s hard to see how OCSP provides any security benefits. Adam Langley, an engineer at Google, compared this problem to \u201ca seat-belt that snaps when you crash<\/a>.\u201d<\/p>\n According to Mozilla\u2019s telemetry<\/a>, nearly 9% of successful OCSP checks take more than 1 second. This second adds to the time it takes to establish the SSL\/TLS handshake, and represents a significant increase to overall load time.<\/p>\n In a very small number of cases (less than .05% of the time), a successful check takes over 3 seconds. While that is a very low rate it represents more than 4 million page loads.<\/p>\n Coincidently, Let\u2019s Encrypt\u2019s OCSP service failed earlier this month<\/a> for about 12 hours, causing performance issues for websites using their certificates. Last year the CA GlobalSign also suffered an issue related to their OCSP servers<\/a>. These incidents issues raise questions about the net value of OCSP and if it\u2019s causing more harm than good.<\/p>\n