Re: OCSP/HTTPS site issues? Certificate validation?

[Seth Hall <seth () ICIR ORG>]

On Jan 20, 2012, at 4:23 PM, Jeff Kell wrote:

> On 1/20/2012 4:20 PM, Rich Graves wrote:
> > Make sure your registration/quarantine networks allow CRL validation, or at least, don't redirect requests back to 
> > the captive portal.
>
> Is there a list of such animals by domain name?

I attached text files with the URLs for OCSP and CRL endpoints for all of the certificates in Mozilla's root 
certificate bundle.

You can generate the OCSP list yourself with:
curl "https://www.mozilla.org/projects/security/certs/included/"; | grep -E "<ocsp>.+</ocsp>" | grep -v "<\!--" | sed -E 
's/.*<ocsp>(.+)<\/ocsp>.*/\1/' | sort | uniq

And you can generate the CRL list with:
curl "https://www.mozilla.org/projects/security/certs/included/"; | grep -E "<crl url=\"[^\"]" | sed -E 's/.*<crl 
url=\"(.+)\".*/\1/' | sort | uniq

  .Seth

Attachment: crl_urls.txt
Description:

Attachment: ocsp_urls.txt
Description:

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/