Bug: OCSP timeout and refresh page

[BugRepor42]

I browse on paranoid mode, and have Pale Moon configured to reject pages in case OCSP response does not arrive.

Issue 1: Unfortunately, a lot of OCSP servers are slow and take long time to respond and the page times out.

Bug / Issue 2: When OCSP request times out/unavailable, hitting refresh button does not restart OCSP request process, instead it attempts to restart handshake. This, with my configuration of mandatory OCSP look-up, does nothing.

Possible fix:

If Pale Moon is configured to "When an OCSP server connection fails, treat the certificate as invalid", refresh button also has to re-attempt OCSP request.

Thank you, and keep up good work!

[joe04]

Soft fail is an inherent flaw of OCSP, not a browser bug. All browsers that use OCSP have it set to soft fail as a necessary default, because hard fail mode exposes the flaws of the system itself. (This is what OP is experiencing.)

Some more info:
viewtopic.php?f=26&t=13105

[Moonchild]

It's not an inherent flaw of the protocol itself, but it is a common occurrence that OCSP requests time out for a multitude of reasons (most often due to routing or due to overload of the OCSP server). Because the "soft fail" approach is common for all web browsers by default, with some even going ahead and trying to be their own revocation server preferred over industry-standard OCSP use (either stapled or not), there isn't much pressure to solve failing OCSP requests. And there we have the status quo for OCSP in a nutshell.