[websec] Revocation check failures for HSTS sites

[Adam Langley <[e-mail]>]

Currently Chrome treats revocation check failures as fatal for HSTS
sites. This is scheduled to change with Chrome 12 when revocation
check failures will not be treated differently for HSTS sites.

The reason for this change is that several Google properties are
either already HSTS or are planning/considering enabling it. However,
it's unacceptable that a failure of our CA's servers brings down those
services. Availability of service is very important.

It has been suggested that OCSP stapling solves this issue. However,
only a single OCSP response can be stapled in the current protocol and
chained certificates are now almost ubiquitous. Even if OCSP stapling
were extended to support multiple responses, the size of the OCSP
responses (1-2KB) becomes problematic. Not only is another 2-5KB of
overhead per connection a problem for for some users (it's another
second of latency for dialups), it typically overflows the server's
initial congestion window, causing another round trip. This can be
reconfigured unilaterally on a per-server basis but many clients
enforce it with their flow window.


Cheers

AGL