> -----Ursprüngliche Nachricht----- > Von: owner-openssl-us...@openssl.org [mailto:owner-openssl- > us...@openssl.org] Im Auftrag von Dr. Stephen Henson > Gesendet: Dienstag, 28. Juli 2009 23:43 > An: openssl-users@openssl.org > Betreff: Re: OCSP_basic_verify:root ca not trusted > > On Tue, Jul 28, 2009, Randy Turner wrote: > > > Is the OCSP response verification algorithm described below > implemented > > exclusively by OpenSSL, or is the algorithm an implementation > > of a particular RFC algorithm? > > > > It is follows the rules in RFC2560. The CA signing and delegate signing > are > taked directly from RFC2560. It also allows a CA which "Matches a local > configuration of OCSP signing authority for the certificate in > question" and > that's the "global responder" configuration option.
[NM] RFC2560 says: "All definitive response messages SHALL be digitally signed. The key used to sign the response MUST belong to one of the following: -- the CA who issued the certificate in question -- a Trusted Responder whose public key is trusted by the requester -- a CA Designated Responder (Authorized Responder) who holds a specially marked certificate issued directly by the CA, indicating that the responder may issue OCSP responses for that CA" We have the second case: The responder has to be trusted to answer requests in this manner. That's why we already have the responder's signer certificate in /etc/ssl/certs. Still, the response verification fails. We probably have to trust the root CA for OCSP signing as stated in http://www.openssl.org/docs/apps/ocsp.html: "If the OCSP responder is a ``global responder'' which can give details about multiple CAs and has its own separate certificate chain then its root CA can be trusted for OCSP signing. For example: openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem" So that's what we are going to test next... Mit freundlichen Grüßen / Kind regards Natanael Mignon IT-Dienstleistungen: beraten | planen | umsetzen | betreiben __________________________________________________________________________ fon (+49) 511 260 911-0 (DW: - 13) fax (+49) 511 318 039-9 eMail n...@michael-wessel.de web www.michael-wessel.de Bitte senden Sie wichtige E-Mails stets auch an serv...@michael-wessel.de, um sicherzustellen, dass diese zeitnah bearbeitet werden. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org