2

Context

I'm developping my own OCSP responder which signed its ocsp responses with its own self signed certificate caOcspBC.crt. You can find it here : https://github.com/Dinou/ocspResponder I want to get the revocation status from a certificate RC.crt issued from a CA certificate CA.crt thanks to openssl.

All my certificates are located here : https://github.com/Dinou/ocspResponder/tree/master/src/main/resources/certificates

So, I execute this first command where I explicitly trust my ocsp certificate thanks to -VAfile option :

# openssl ocsp -issuer CA.crt -VAfile caOcspBC.crt -cert RC.crt -req_text -url http://responderurl:port/myServlet OCSP Request Data: Version: 1 (0x0) Requestor List: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: 19266539D5B4B518D4382B2D3779CBF53A6061D6 Issuer Key Hash: 89B91685082EF65F5611F965E94422D602BE27DB Serial Number: 0A Request Extensions: OCSP Nonce: 04106D042BFA97BFA61F5AAAD756C5619CF2 Response verify OK RC.crt: good This Update: May 19 14:51:51 2014 GMT

It works well.

If I don't use the -VAfile option I get :

# openssl ocsp -issuer CA.crt -cert RC.crt -req_text -url http://responderUrl:port/myServlet OCSP Request Data: Version: 1 (0x0) Requestor List: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: 19266539D5B4B518D4382B2D3779CBF53A6061D6 Issuer Key Hash: 89B91685082EF65F5611F965E94422D602BE27DB Serial Number: 0A Request Extensions: OCSP Nonce: 0410C8D048BB5A49596A7714B4D74935E3C5 Response Verify Failure 140451402069696:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:126:Verify error:unable to get local issuer certificate RC.crt: good This Update: May 19 14:52:09 2014 GMT

It doesn't work. In fact my client openssl doesn't trust my ocsp certificate.

Problem

But I want to use Apache mod_ssl with my generic OCSP, and there is no directive mapping to the -VAfile option -> I can not specify the trusted responder certificates.

Question

What can I do to make my apache trust my self signed OCSP responder certificate ?

Extra context

I tried many things :

  • I imported my self signed certificate caOcspBC.crt in /etc/ssl/certs by using this : http://gagravarr.org/writing/openssl-certs/others.shtml#selfsigned-openssl (symbolic link) It didn't work (Same error as was mentioned previously ocsp_vfy.c:126:Verify error:unable to get local issuer certificate)

  • In openssl ocsp documentation states :

    If the OCSP responder is a ``global responder'' which can give details about multiple CAs and has its own separate certificate chain then its root CA can be trusted for OCSP signing. For example: openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem Alternatively the responder certificate itself can be explicitly trusted with the -VAfile option.

So, I executed this command on my self signed certificate and then I put It in /etc/ssl/certs as was mentioned previously.

It didn't work (Same error as was mentioned previously ocsp_vfy.c:126:Verify error:unable to get local issuer certificate)

Improve this question

1 Answer 1

Reset to default
1

Question

What can I do to make my apache trust my self signed OCSP responder certificate ?

Answer

First, the self signed certificate must have these following properties :

  • KeyUsage : digitalSignature, nonRepudiation, keyEncipherment, keyCertSign
  • ExtendedKeyUsage : OCSPSigning
  • BasicConstraints : critical,CA:TRUE, pathlen:0

It must be in pem format.

Then, apply the following command to the certificate :

openssl x509 -in selfSignedCert.pem -addtrust OCSPSigning -out trusted.pem

And finally append it to the file specified in ssl.conf in Apache by SSLCACertificateFile directive

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .