Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion

"Users of Mozilla Firefox that are concerned about this issue should enable security.OCSP.require in the about:config dialog."

How can i enable this feature in Google Chrome?

share|improve this question

migrated from security.stackexchange.com Mar 24 '11 at 9:46

This question came from our site for Information security professionals.

    
possible duplicate of “security.OCSP.require” in Google Chrome –  Kez Mar 24 '11 at 11:44

2 Answers 2

up vote 2 down vote accepted

There is no about:config in Chrome so there is no way (that I am aware of) to force OCSP usage. However, it should use OCSP by default and fallback to CRLs if that doesn't work. Plus, the web browsers have blacklisted the serial numbers of the stolen certificates directly in the web browser so if you upgrade your web browser you will be completely protected.

share|improve this answer

You'll be completely protected... THIS time. OCSP and CRL checking are a joke if the browser doesn't refuse the connection should the OCSP or CRL services prove (or appear) to be offline. As far as I'm concerned all browsers should refuse connections when the certificate can't be verified, but browser makers are loath to do so because users would blame the browser for any problems they experience, and likely switch over to another with looser restrictions.

The setting can be found in: Google Chrome > Settings > Advanced settings > Security > Check server for revocation (or something along those lines.. I'm using a Dutch version)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.