Re: reduce default OCSP timeouts.

2013-10-14 Thread Gervase Markham
On 11/10/13 21:50, Wan-Teh Chang wrote: > I would use a timeout of 5 seconds. 3 seconds seem a little short. > > I agree 10 seconds are too long. Can you expand on what criteria you are using to make these judgements? Fetching the OCSP response takes 2RTT, as Camilo said. So if your RTT is 1000m

Re: reduce default OCSP timeouts.

2013-10-11 Thread Camilo Viecco
On 10/11/13 1:58 PM, Eddy Nigg wrote: On 10/11/2013 11:50 PM, From Wan-Teh Chang: I would use a timeout of 5 seconds. 3 seconds seem a little short. I agree 10 seconds are too long. +1 Thanks Eddy/Wan Tech: 5 seconds seems too high for a fail open option, but let me ask you: what percent o

Re: reduce default OCSP timeouts.

2013-10-11 Thread Camilo Viecco
On 10/11/13 1:39 PM, Bob Clary wrote: On 10/11/2013 12:57 PM, Camilo Viecco wrote: Hello List I am planning to land a patch to reduce the default (soft-fail) OCSP network timeout values. Currently OCSP connections timeout after 10 seconds and my plan is to changed that to 3 seconds (hard fail w

Re: reduce default OCSP timeouts.

2013-10-11 Thread Eddy Nigg
On 10/11/2013 11:50 PM, From Wan-Teh Chang: I would use a timeout of 5 seconds. 3 seconds seem a little short. I agree 10 seconds are too long. +1 -- Regards Signer: Eddy Nigg, StartCom Ltd. XMPP:start...@startcom.org Blog:http://blog.startcom.org/ Twitter: http://twitter.com/eddy_ni

Re: reduce default OCSP timeouts.

2013-10-11 Thread Bob Clary
On 10/11/2013 12:57 PM, Camilo Viecco wrote: Hello List I am planning to land a patch to reduce the default (soft-fail) OCSP network timeout values. Currently OCSP connections timeout after 10 seconds and my plan is to changed that to 3 seconds (hard fail will keep the current 10 second timeout

reduce default OCSP timeouts.

2013-10-11 Thread Camilo Viecco
Hello List I am planning to land a patch to reduce the default (soft-fail) OCSP network timeout values. Currently OCSP connections timeout after 10 seconds and my plan is to changed that to 3 seconds (hard fail will keep the current 10 second timeout value). With this change (according to te