Re: [PATCH v5] http: add http.sslVerifyStatus to check stapled OCSP responses

From: Junio C Hamano <gitster@pobox.com>
Date: Aug 18, 2026, 20:12 UTC
Message-ID: <xmqqo6ezw5l1.fsf@gitster.g>
In-Reply-To: <20260818193710.56955-1-ggordon@gitlab.com>

graysongordon-gl <graysongordon1@gmail.com> writes:

Show 8 quoted lines

> +http.sslVerifyStatus::
> +	Whether to check the revocation status of the server
> +	certificate using the stapled OCSP response supplied during
> +	the TLS handshake ("OCSP stapling"). Defaults to false.
> ++
> +This is fail-closed: if the server staples no response, verification
> +fails. Set it per remote, e.g.
> +`http.https://example.com/.sslVerifyStatus`, rather than globally.

I do not see us describe a knob or setting that can stop the operation depending on some condition as "fail-closed". Can we rephrase this for regular human beings? Perhaps

	Whether to refuse connecting to the server when its
	certificate has been revoked.  Default to false, allowing
	connection even when its certificate is not known to be
	still valid.

or something like that might be a good starting point. After all, the "check revocation and/or validity" is *not* the primary objective from the end-user's point of view. Ensuring that they do not talk to suspicious servers is.

Thanks.