Java Enhancement Proposal 249, OCSP Stapling for TLS, implements OCSP stapling via the TLS certificate status request extension. OSCP stapling checks the validity of X.509 certificates.
X.509 certificates are digital certificates that use the X509 Public Key Infrastructure (PKI).
Prior to Java 9, the certificate validity check (really, the check to see if the certificate has been revoked) can be enabled on the client side and has the following inefficiencies:
- OCSP responder performance bottlenecks
- Performance degradation based on multiple passes
- Additional performance degradation if OCSP checking is performed client side
- False fails when browsers do not connect to an OCSP responder
- Susceptibility of denial ...
