I am trying to figure out the details of OCSP stapling and how it works. As often the best way is, I started Wireshark and made a simple request to a server that has OCSP stapling enabled.
Can anyone please clarify the below doubts I have?
Client Hello extension data:
In Wireshark I see the client hello extension as below
Extension: status_request Type: status_request (0x0005) Length: 5 Certificate Status Type: OCSP (1) Responder ID list Length: 0 Request Extensions Length: 0
I understand the presence of the first two fields. But why do we need the next 3 (
Certificate Status Type,
Responder ID list Length,
Request Extensions Length) as they are
0anyways. What kind of data can they contain and how is the server supposed to process data in these fields?
Part of the response is:
Certificate Status Type: OCSP (1) ResponseType Id: 18.104.22.168.22.214.171.124.1.1 (id-pkix-ocsp-basic) BasicOCSPResponse tbsResponseData responderID: byKey (2) byKey: f2026c2ad426a4a59cb2505b3962446034151e5b
What are the fields
ResponseType ID? And how is the client supposed to process the same? Does the client need to match the
Certificate status typewith what was sent in the client hello?
I understand that revocation checks need to be done for all certificates in the chain. How does this fit in with stapling? We are doing a handshake only once. Is the server responsible to maintain revocation status of all certs in the chain?