Is it possible to allow OCSP requests using for example iptables or Squid? I'm doing an experiment where I reject insecure outgoing HTTP requests, but OCSP is of course a valid exception since the response is validated by the browser. Or is there at least some way to identify OCSP HTTP requests uniquely so as to write a custom filter for it?

Alternatively, is there an official list of IPs/subnets that are used for OCSP? This looks promising, since the author is forcing HTTPS in a different way, but there's no guarantee of it being maintained.


This is probably beyond iptables; you're asking for filtering at the application layer which is pretty complex. I think you're going to have to look into squid paired with iptables that forces all http to go thru it.

Edit: Please see question history before downvoting; the original question has been updated with the content of this answer.

  • Interesting suggestion, but I think Squid is a bit too much work to set up. – l0b0 Sep 4 '17 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.