Pretty much this is request for additional information for the question: https://stackoverflow.com/questions/9607516/openssl-certificate-revocation-check-in-client-program-using-ocsp-stapling
I want to know how OpenSSL actually handles OCSP stapling response. Questions are:
Does the OpenSSL check the signature, issuer key/name hashes of the response?
Does the response include OCSP responses for the whole certificate chain? If so, is there a way to know that one of the validations have failed?
- To sum up, can I simply rely on 'Cert Status: good' field of the response? :)
My concern is that hacker may craft https server using revoked (stolen) certificate but during handshake provide valid stapled OCSP response for a random website that was certified by the same CA issuer. Could the OpenSSL handle such situation?
The sample OCSP response can be found here https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html#testing-ocsp-stapling