Bonjour,
If the OCSP URL isn't found in the supplied certificate, you're trying
to find it in its issuer? That's not standard, even if it can work.
It seems you're looking for the issuer by its subject name. When you
have several CA certificates with the same name in your store (that's
permitted), you may not get the real issuer certificate, and the
calculated issuerKeyHash will be wrong.
Please don't add a nonce, at least not by default. Looking at our busy
OCSP responders, *nobody* asks for a nonce, and it's perfect like this.
Having a nonce may provide you a benefit, but it defeats CA
optimizations (cached responses, mainly).
It seems the supplied code doesn't check for a dedicated OCSP
responder's certificate validity (not necessary if this certificate has
an OCSPNoCheck extension, but some don't have this extension).
Le 08/06/2012 13:07, Alexander Komyagin a écrit :
[...]
How it works:
1) OCSP revocation check is done right before CRL check
2) first, OpenSSL tries to get the OCSP url for the certificate being
checked - it's either forced url or embedded into the certificate.
3) if it fails, issuer shall be found
4) if OCSP validation for issuer is disabled, we completely trust him
and the check is successful.
5) otherwise, we extract issuer OCSP url the same way as in (2) and use
it to check.
=========================
Possible errors:
- X509_V_ERR_CERT_UNKNOWN [OCSP responder never heard about this
certificate]
- X509_V_ERR_CERT_REVOKED [Certificate had been revoked]
- X509_V_ERR_APPLICATION_VERIFICATION [for everything else]
========================
P.S> OCSP querying code was taken from OpenSSL ocsp app. Also I still
want to add additional error codes for reporting OCSP-related failures
during verification (obviously, APPLICATION_VERIFICATION_FAILURE doesn't
tell you much).
--
Erwann ABALEA
-----
Un forum peut répondre à plusieurs besoins à la fois
Ici, le groupe des débutants dépasse en nombre le groupe des utilisateur
"middle-class" ce qui provoque inévitablement des tensions.
-+- EF - Guide du Neuneu d'Usenet - La lutte des middle classes -+-
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [email protected]
Automated List Manager [email protected]
