Hi, I tried to validate a certificate from Comodo using their OCSP, but I cannot verify the response:
3073455752:error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found:ocsp_vfy.c:85: The certificate I want to validate was issued by C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO High-Assurance Secure Server CA The cert chain is: 0: <The certificate I want to validate> 1: COMODO High-Assurance Secure Server CA 2: AddTrust External CA Root (aka USERTrust) My steps: 1) # wget -O level1.pem "https://support.comodo.com/index.php?dload=Download&_m=downloads&_a=downloadfile&downloaditemid=101"; 2) Verifying the level1.pem certificate (COMODO High-Assurance Secure Server CA), this check will also make sure, that the root certificate (level2) is present on my system: # openssl verify -CApath /etc/ssl/certs/ level1.pem level1.pem: OK 3) Now I created the OCSP request: # openssl ocsp -CApath /etc/ssl/certs -CAfile level1.crt \ -issuer level1.crt -cert level0.crt \ -url http://ocsp.comodoca.com \ -reqout request.der To share it with you, I called base64 on request.der: # base64 request.der MHYwdDBNMEswSTAJBgUrDgMCGgUABBT950qEosxt1h7EdDv7v4q+SjikWAQUP9W10NZEeVBKF6Ob jErcuLAiZGsCEExO1VM4XfiatpW5unQb4gOiIzAhMB8GCSsGAQUFBzABAgQSBBAo6nzdxvtLR5Gi hO44WuHv So you can grab the response from <http://ocsp.comodoca.com/MHYwdDBNMEswSTAJBgUrDgMCGgUABBT950qEosxt1h7EdDv7v4q+SjikWAQUP9W10NZEeVBKF6ObjErcuLAiZGsCEExO1VM4XfiatpW5unQb4gOiIzAhMB8GCSsGAQUFBzABAgQSBBAo6nzdxvtLR5GihO44WuHv> When I compare against responses from ocsp.verisign.com or ocsp.globalsign.com I am missing the OCSP responder certificate in the response. So my question is: 1) Is it ok, what Comodo is doing here? 2) If it is OK, how can I be sure, that the response is from a valid source, when I cannot validate (=or how can I validate this certificate/response)? Thanks. /etc/ssl/certs is from ca-certificates package (20130119) I am using OpenSSL 1.0.1e 11 Feb 2013 -- Regards, Igor ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
