Is it possible to allow OCSP requests using for example iptables or Squid? I'm doing an experiment where I reject insecure outgoing HTTP requests, but OCSP is of course a valid exception since the response is validated by the browser. Or is there at least some way to identify OCSP HTTP requests uniquely so as to write a custom filter for it?

Alternatively, is there an official list of IPs/subnets that are used for OCSP? This looks promising, since the author is forcing HTTPS in a different way, but there's no guarantee of it being maintained.

1 Answer 1


This is probably beyond iptables; you're asking for filtering at the application layer which is pretty complex. I think you're going to have to look into squid paired with iptables that forces all http to go thru it.

Edit: Please see question history before downvoting; the original question has been updated with the content of this answer.

  • Interesting suggestion, but I think Squid is a bit too much work to set up.
    – l0b0
    Sep 4, 2017 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .