[SSL] OCSP check times out

[ameshkov]

Problem

OCSP check can time out. In this case AG makes an async check with an infinite timeout. The problem here is that until that check is finished AG counts cert valid.

Why?

OCSP servers are slow so revocation check can easily timed out.

What can we do?

1. Increase default OCSP check timeout
2. Use CRLSet just like Chrome does.

It is not very good solution though:
https://www.imperialviolet.org/2014/04/29/revocationagain.html
https://code.google.com/p/chromium/issues/detail?id=361820
https://www.grc.com/revocation/crlsets.htm
http://www.zdnet.com/article/chrome-does-certificate-revocation-better/

[ameshkov]

Chromium code:
http://src.chromium.org/viewvc/chrome/trunk/src/net/cert/cert_verify_proc_win.cc

They do no revocation check except CRLSet on the main thread for non-EV certs, only async check.

[ameshkov]

At least we should implement OCSP stapling

[gshumihin]

OCSP stapling implemented