Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I use privoxy. In the user.action file i have a redirect rule and a few websites:

{ +redirect{s@http://@https://@} }
.twitter.com
.facebook.com

Ok! it's working great, e.g.: if i visit any "*twitter.com" URL it gets redirected to HTTPS!

But: with wireshark i can see some OCSP (Online Certificate Status Protocol) packets.

Question: What are these packets? Why aren't there in HTTPS?

Is my redirection method with privoxy is secure?

Thank you for any tips/opinions!

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

OCSP is a way for programs that use X.509 certificates (such as anything using SSL, like web browsers for https: URLs) to check whether a certificate has been revoked because it was compromised.

You're not seeing them when using https: directly because you would need a packet tracer that can decrypt SSL and the SSL certificate used for encryption — which in most cases you won't have.

share|improve this answer
    
thanks, i checked again with wireshark, and i didn't see OCSP over HTTP –  LanceBaynes Mar 9 '11 at 10:34
    
You won't see them for http; they're only useful with https, because only https uses certificates. –  geekosaur Mar 9 '11 at 10:35
add comment

It is a replacement for Certificate Revocation Lists. Instead of having to download a (very huge) list of all revoked certificates for each root certificate, a remote server can be queried for just the status of a specific certificate.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.