2

Pretty much this is request for additional information for the question: https://stackoverflow.com/questions/9607516/openssl-certificate-revocation-check-in-client-program-using-ocsp-stapling

I want to know how OpenSSL actually handles OCSP stapling response. Questions are:

  1. Does the OpenSSL check the signature, issuer key/name hashes of the response?

  2. Does the response include OCSP responses for the whole certificate chain? If so, is there a way to know that one of the validations have failed?

  3. To sum up, can I simply rely on 'Cert Status: good' field of the response? :)

My concern is that hacker may craft https server using revoked (stolen) certificate but during handshake provide valid stapled OCSP response for a random website that was certified by the same CA issuer. Could the OpenSSL handle such situation?

The sample OCSP response can be found here https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html#testing-ocsp-stapling

2

how OpenSSL actually handles OCSP stapling response

OpensSL does not do anything by its own in this area. You have to explicitly deal with OCSP stapling in your code, both for signaling that you support stapling and for validating and interpreting the response.

Does the OpenSSL check the signature, issuer key/name hashes of the response?

If the proper functions are used you can do it. Validating a OCSP response is in most ways similar to validating a certificate or a CRL, i.e. validating the trust chain. Apart from that you need to verify that the OCSP response is actually for the correct certificate.

Does the response include OCSP responses for the whole certificate chain? If so, is there a way to know that one of the validations have failed?

This depends on what the server sends and what the client requests (i.e. single OCSP response or multiple). And since you have to implement all the details anyway you have also the information what part of the validation failed.

To sum up, can I simply rely on 'Cert Status: good' field of the response? :)

No, you cannot simply trust any OCSP response sent by the server.
You have to do all the validation of the OCSP response yourself. Apart from the already mentioned parts this involves also checking if the response is stale (too old). And of course the certificate might have been revoked in the last minutes but the response is still valid, i.e. OCSP does not provide real-time information about the status of a certificate.

Note that only very OpenSSL based tools or libraries implement OCSP and/or OCSP stapling at all and even if they do it is usually not enabled by default. This is not much different with other TLS implementations.

  • In consideration of the fact that trying to design and code the verification oneself is more to be buggy than a design and coding which has already undergone testing and public scrutiny, it would seem well advised to search for such established efforts. Do you have any knowledge or recommendations about such efforts? // I have been able to find nothing substantial at all. – Craig Hicks Sep 15 '17 at 23:08
  • @CraigHicks: The public available implementation I know well is the one I did for Perl inside IO::Socket::SSL and Net::SSLeay. It's an attempt to provide an easy to use OCSP check on top of the complex API provided by OpenSSL. It's already used in practice for some years. – Steffen Ullrich Sep 16 '17 at 4:42
  • Thanks Stefan! I am looking at the code for swaks and your code seems to be called from there. I am honored to have received your assistance. – Craig Hicks Sep 17 '17 at 5:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.