Check the certification chain with ocsp

Question

I have an architecture with a root ca and a sub ca like this:

root ca > sub ca > server <----------> external client

The root ca delivers a certificate for the sub ca. The sub ca delivers a certificate for the internal server.

So I have two ocsp responders: one in the root ca and another in the sub ca.

My goal is to check the certification chain with ocsp from the external client.

I use the command:

openssl ocsp -issuer sub-ca.crt -CAfile sub-ca-and-ca_mere.crt -cert interne.crt -url http://ipa-ca.sub.cedricdomaine.fr/ca/ocsp

sub-ca.crt is the certificate for the sub ca.

sub-ca-and-ca_mere is the concatenation of sub ca certificate and root ca both.

interne.crt is the certificate for the server.

I wonder which url to use after the option -url because i have two ocsp responder: the sub ca's one or the root ca's one?

Answer 1

I've had the same question myself and by research as well as by practical tests I found out, that the openssl ocsp command is not able to verify complete certificate chains.

You can only verify one "step" at once, so you would need to issue

openssl ocsp -issuer sub-ca.crt -CAfile sub-ca-and-ca_mere.crt -cert interne.crt -url http://ipa-ca.sub.cedricdomaine.fr/ca/ocsp

to verify the validity of the server certificate and something line

openssl ocsp -issuer root-ca.crt -CAfile root-ca.crt -cert sub-ca.crt -url http://ipa-ca.root.cedricdomaine.fr/ca/ocsp

to verify the validity of the sub-ca certificate.

A "clever" client (browser, e. g.) however should probably do it the same way, sending multiple requests to multiple OCSP responders along the chain, given the corresponding responder URL is mentioned in each certificate.