When a client is unable to contact an OCSP responder, it neither acquires a positive or a negative response for certificate validity.
In this state, it should accept non-MustStaple certificates in order to prevent transient network faults from compromising availability.
Windows' SChannel library defaults to hard-failing on detecting an unavailable certificate. We should try and use the SCH_CRED_IGNORE_REVOCATION_OFFLINE flag to change this behaviour.
- depends on
-
SERVER-46633 Windows TLS implementation may declare hostname mismatch on unrelated error
-
- Closed
-