(In reply to Robin Alden from comment #98)
> We saw no sign whatsoever (that's none - not even a little bit) of OCSP
> traffic for those certificates from Iran, and none from anywhere else other
> than a handful of hits from security researchers.
I wonder what such facts are worth considering that OCSP traffic can be blocked at the same place where you do your MITM attack…
(In reply to Robin Alden from comment #98)
> We saw no sign whatsoever (that's none - not even a little bit) of OCSP
> traffic for those certificates from Iran, and none from anywhere else other
> than a handful of hits from security researchers.
I wonder what such facts are worth considering that OCSP traffic can be blocked at the same place where you do your MITM attack…