Hi, Erwann! Thanks for your comments. On Fri, 2012-06-08 at 16:54 +0200, Erwann Abalea wrote: > Bonjour, > > If the OCSP URL isn't found in the supplied certificate, you're trying > to find it in its issuer? That's not standard, even if it can work.
Yeah, my bad. Wasn't a good idea. > > It seems you're looking for the issuer by its subject name. When you > have several CA certificates with the same name in your store (that's > permitted), you may not get the real issuer certificate, and the > calculated issuerKeyHash will be wrong. Nice catch! I think I can use already formed ctx->chain for that purpose. > > Please don't add a nonce, at least not by default. Looking at our busy > OCSP responders, *nobody* asks for a nonce, and it's perfect like this. > Having a nonce may provide you a benefit, but it defeats CA > optimizations (cached responses, mainly). Hmm... probably introducing some new verification flag X509_OCSP_USE_NONCE would be sufficient. > > It seems the supplied code doesn't check for a dedicated OCSP > responder's certificate validity (not necessary if this certificate has > an OCSPNoCheck extension, but some don't have this extension). OCSP responder's certificate revocation status is only checked against CRL's. (via OCSP_basic_verify()). > > Le 08/06/2012 13:07, Alexander Komyagin a écrit : > > [...] > > How it works: > > > > 1) OCSP revocation check is done right before CRL check > > 2) first, OpenSSL tries to get the OCSP url for the certificate being > > checked - it's either forced url or embedded into the certificate. > > 3) if it fails, issuer shall be found > > 4) if OCSP validation for issuer is disabled, we completely trust him > > and the check is successful. > > 5) otherwise, we extract issuer OCSP url the same way as in (2) and use > > it to check. > > > > ========================= > > Possible errors: > > - X509_V_ERR_CERT_UNKNOWN [OCSP responder never heard about this > > certificate] > > - X509_V_ERR_CERT_REVOKED [Certificate had been revoked] > > - X509_V_ERR_APPLICATION_VERIFICATION [for everything else] > > > > > > ======================== > > > > P.S> OCSP querying code was taken from OpenSSL ocsp app. Also I still > > want to add additional error codes for reporting OCSP-related failures > > during verification (obviously, APPLICATION_VERIFICATION_FAILURE doesn't > > tell you much). > > > > -- Best wishes, Alexander Komyagin ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
