They are doing a CA signed OCSP response, this is legitimate. We will do this in the not so distant future as well for many of our responses also.
You basically need to look at the responderID and see if it's the same entity that signed the certificate you are checking if so use that key material to do the validation. Ryan -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Igor Sverkos Sent: Wednesday, June 12, 2013 4:41 PM To: [email protected] Subject: Is it me or is ocsp.comodoca.com doing something wrong? Hi, I tried to validate a certificate from Comodo using their OCSP, but I cannot verify the response: 3073455752:error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found:ocsp_vfy.c:85: The certificate I want to validate was issued by C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO High-Assurance Secure Server CA The cert chain is: 0: <The certificate I want to validate> 1: COMODO High-Assurance Secure Server CA 2: AddTrust External CA Root (aka USERTrust) My steps: 1) # wget -O level1.pem "https://support.comodo.com/index.php?dload=Download&_m=downloads&_a=downloa dfile&downloaditemid=101" 2) Verifying the level1.pem certificate (COMODO High-Assurance Secure Server CA), this check will also make sure, that the root certificate (level2) is present on my system: # openssl verify -CApath /etc/ssl/certs/ level1.pem level1.pem: OK 3) Now I created the OCSP request: # openssl ocsp -CApath /etc/ssl/certs -CAfile level1.crt \ -issuer level1.crt -cert level0.crt \ -url http://ocsp.comodoca.com \ -reqout request.der To share it with you, I called base64 on request.der: # base64 request.der MHYwdDBNMEswSTAJBgUrDgMCGgUABBT950qEosxt1h7EdDv7v4q+SjikWAQUP9W10NZEeVBK MHYwdDBNMEswSTAJBgUrDgMCGgUABBT950qEosxt1h7EdDv7v4q+F6Ob jErcuLAiZGsCEExO1VM4XfiatpW5unQb4gOiIzAhMB8GCSsGAQUFBzABAgQSBBAo6nzdxvtLR5Gi hO44WuHv So you can grab the response from <http://ocsp.comodoca.com/MHYwdDBNMEswSTAJBgUrDgMCGgUABBT950qEosxt1h7EdDv7v4 q+SjikWAQUP9W10NZEeVBKF6ObjErcuLAiZGsCEExO1VM4XfiatpW5unQb4gOiIzAhMB8GCSsGAQ UFBzABAgQSBBAo6nzdxvtLR5GihO44WuHv> When I compare against responses from ocsp.verisign.com or ocsp.globalsign.com I am missing the OCSP responder certificate in the response. So my question is: 1) Is it ok, what Comodo is doing here? 2) If it is OK, how can I be sure, that the response is from a valid source, when I cannot validate (=or how can I validate this certificate/response)? Thanks. /etc/ssl/certs is from ca-certificates package (20130119) I am using OpenSSL 1.0.1e 11 Feb 2013 -- Regards, Igor ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected] ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
