PKI · Question 12 of 12
A company finds that clients still accept revoked certificates when the OCSP server is unreachable. What is this behavior called?
1 answer is correct. Hard
Show answer
Answer
- A Soft-fail
Explanation
Many clients accept a certificate when the revocation check fails (soft-fail) so that users are not blocked during every OCSP outage. Attackers can exploit this by blocking the check. Hard-fail would reject the connection in that case. OCSP stapling with "must-staple" reduces the problem.