Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use privoxy. In the user.action file i have a redirect rule and a few websites:

{ +redirect{s@http://@https://@} }

Ok! it's working great, e.g.: if i visit any "*twitter.com" URL it gets redirected to HTTPS!

But: with wireshark i can see some OCSP (Online Certificate Status Protocol) packets.

Question: What are these packets? Why aren't there in HTTPS?

Is my redirection method with privoxy is secure?

Thank you for any tips/opinions!

share|improve this question
up vote 2 down vote accepted

OCSP is a way for programs that use X.509 certificates (such as anything using SSL, like web browsers for https: URLs) to check whether a certificate has been revoked because it was compromised.

You're not seeing them when using https: directly because you would need a packet tracer that can decrypt SSL and the SSL certificate used for encryption — which in most cases you won't have.

share|improve this answer
thanks, i checked again with wireshark, and i didn't see OCSP over HTTP – LanceBaynes Mar 9 '11 at 10:34
You won't see them for http; they're only useful with https, because only https uses certificates. – geekosaur Mar 9 '11 at 10:35

It is a replacement for Certificate Revocation Lists. Instead of having to download a (very huge) list of all revoked certificates for each root certificate, a remote server can be queried for just the status of a specific certificate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.