mirror of
https://gitlab.com/gnuwget/wget2.git
synced 2026-02-01 04:10:48 +00:00
35986bd093
* docs/wget2.md: Document --ocsp default value as 'off'.
* src/options.c (struct config): Disable .ocsp by default.
OCSP validation of the server certificate implies privacy issues:
- The OCSP request tells the CA which web service the client tries to reach.
- The OCSP requests are sent via unencrypted HTTP, so every "listener in the
middle" can see which web service the client tries to connect.
Additionally, the OCSP requests slow down operation and may cause unexpected
network traffic, which may trigger security alarms unnecessarily.
Due to these issues we explicitly disable OCSP by default.
