Re: Skipping DNS resolutions with ORIGIN frame


If the client doesn't send the "SCT" or "OCSP Stapling" support, then the
server can't send them. What if the requirement for OCSP Stapling and CT
Qualification was contingent on the client sending that extension? If the
client supports CT and/or OCSP, then the server must send them for the
client to accept the ORIGIN. If the client does not advertise support for
these features, then they're not mandatory for the client to accept ORIGIN.


On Mon, Jul 17, 2017 at 7:28 PM Daniel Stenberg <> wrote:

> On Mon, 17 Jul 2017, Emily Stark wrote:
> > Is it reasonable to assume that all clients implementing ORIGIN will also
> > implement CT?
> I think that's a stretch. It is easy to see how supporting ORIGIN can be an
> obvious benefit to a lot of libraries and tools (ie non-browsers) that
> want to
> coalesce/reuse connections better and that might very well be implemented
> without doing CT or at least independently of it.
> --
>   /

Received on Tuesday, 18 July 2017 10:38:10 UTC