Does the .NET HttpWebRequest class support OCSP stapling?

Luigi Sorrentino 1

We're looking to configure our .NET application to use OCSP stapling.

1 answer

Bruce Zhang-MSFT 3,736 Reputation points

2020-12-07T09:19:29.493+00:00
Hi @Luigi Sorrentino ,

Yes, it supports OCSP stapling.

By default, OCSP support is enabled for IIS websites that have a simple secure (SSL/TLS) binding. However, this support is not enabled by default if the IIS website is using either or both of the following types of secure (SSL/TLS) bindings:

Require Server Name Indication

Use Centralized Certificate Store

More information can get from the document.

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our  documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards,
Bruce Zhang
Please sign in to rate this answer.
Captain_Lou 26 Reputation points

2020-12-07T14:45:03.057+00:00

Hi @Bruce Zhang-MSFT

Our .NET 3.5 application uses the HttpWebRequest class to establish TLS connections to hosted backend services and it does not make use of our Apache web server's stapled response (to confirm whether or not the SSL certificate is valid). The application performs the CRL or OCSP call on its own.

We can’t find any information which states whether or not .NET WebClient, HttpClient or HttpWebRequest classes support OCSP stapling configured in Apache server.

Bruce Zhang-MSFT 3,736 Reputation points

2020-12-08T01:53:50.557+00:00

Hi @Captain_Lou ,

Apache server is not a Microsoft product, and I cannot give you an accurate answer. You can go to the apache related forum to ask this question.

Captain_Lou 26 Reputation points

2020-12-08T14:22:27.773+00:00

Hi @Bruce Zhang-MSFT ,

I confirmed that various web browsers (Edge, Chrome and Firefox) triggered Apache to make calls to the OCSP responder when they hit the Apache page.

Since that worked, we are trying to determine why our .NET 3.5 application accessing the same Apache server does not invoke the OCSP stapling.

Are there any settings within .NET 3.5 that need to be set?

Kevin Stevens 21 Reputation points

2024-02-02T03:33:09.51+00:00

@Captain_Lou did you have any luck looking into this. I'm troubleshooting what I think is a related issue in my own .net client.

@Bruce Zhang-MSFT, please stop referencing IIS. The question is about .NET clients. Not the web servers.
Sign in to comment