not a reliable means of mitigating HTTPS server key compromise. The MustStaple TLS extension in a certificate can require that the certificate be verified by a stapled OCSP response, mitigating this problem. OCSP also remains a valid defense against situations where the attacker is not a "man-in-the-middle" (code-signing or certificates issued in error). The OCSP protocol assumes the requester has network access to connect to an appropriate OCSP responder. Some requesters may not be able to connect because their local network prohibits direct Internet access (a common practice for internal nodes in a data center). Forcing internal servers to connect to the Internet in order to use OCSP contributes to the de-perimeterisation trend. The OCSP stapling protocol is an alternative that allows servers to cache OCSP responses, which removes the need for the requestor to directly contact the OCSP responder. Browser support There is wide support for OCSP amongst most major browsers: Internet Explorer is built on the CryptoAPI of Windows and thus starting with version 7 on Windows Vista (not XP) supports OCSP checking. All versions of Mozilla Firefox support OCSP checking. Firefox 3 enables OCSP checking by default. Safari on macOS supports OCSP checking. It is enabled by default as of Mac OS X 10.7 (Lion). Prior to that, it has to be manually activated in Keychain preferences. Versions of Opera from 8.0 to the current version support OCSP checking. However, Google Chrome is an outlier. Google disabled OCSP checks by default in 2012, citing latency and privacy issues and instead uses their own update mechanism to send revoked certificates to the browser. Implementations Several open source and proprietary OCSP implementations exist, including fully featured servers and libraries for building custom applications. OCSP client support is built into many operating systems, web browsers, and other network software due to the popularity of HTTPS and the World Wide Web. Server Open source Boulder, CA and OCSP responder developed and used by Let's Encrypt (Go) DogTag, Open source certificate authority CA, CRL and OCSP responder. EJBCA, CA and OCSP responder (Java) XiPKI, CA and OCSP responder. With support of RFC 6960 and SHA3 (Java) Proprietary Certificate Services CA and OCSP responder included with Windows Server Library Open source cfssl (Go) OpenSSL (C) wolfSSL (C) Client See also Certificate revocation list Certificate authority Server-based Certificate Validation Protocol OCSP stapling Certificate Transparency References External links RFC 2560, X.509 Internet Public Key Infrastructure