Add expired-ocsp.badssl.com subdomain #54
Conversation
|
Thanks for the PR! Also, could you explain how I could make this work for a real |
I'll look into that. It may be tricky because it will require generating an OCSP response off of the testing intermediate, and the
I think there was a misunderstanding - this is meant to work with the real *.badssl.com cert - the OCSP response I committed is signed by Comodo and is for the actual *.badssl.com cert in production. My commit message was probably unclear about |
|
I see. I haven't worked much with OCSP. I that case, adding something to the script would be preferable – the cert generator should give you the intermediate. In either case, I'll wait until the 8th to merge. Thanks for the explanation. |
AGWA
force-pushed
the
master
branch
2 times, most recently
from
27e3830 to
18eaf58
Compare
|
I just amended the PR to:
|
This subdomain sends an expired stapled OCSP response, which triggers an SSL error in Firefox (and soon in Chrome as well). The OCSP response, certs/wildcard.expired-ocsp.der, was generated by running: openssl ocsp -issuer certs/wildcard.issuer.pem -cert certs/wildcard.normal.pem -url http://ocsp.comodoca.com -noverify -respout certs/wildcard.expired-ocsp.der where certs/wildcard.issuer.pem contains the certificate that issued certs/wildcard.normal.pem (i.e. the first intermediate certificate in the chain). http://ocsp.comodoca.com was taken from the OCSP field as output by `openssl x509 -in certs/wildcard.normal.pem -noout -text`. certs/wildcard.expired-ocsp.der will need to be regenerated whenever wildcard.normal.pem is reissued. Note that, at the time of this commit, certs/wildcard.expired-ocsp.der is not yet expired, but will expire on Jun 8, 2015 at 09:38:45 UTC.
|
Excellent, thanks! Deterministic serial numbers sound fine to me. @marumari: As official definite responsible authoritative If not, I'll merge this on the 9th. |
|
@AGWA I've tried a handful of times, but can't seem to get https://expired-ocsp.badssl.com/ to fail (in Firefox or Chrome). Am I missing something? |
|
@lgarron Hmmm... it's not serving up the stapled OCSP response. Do you see anything in the nginx error log about stapling? |
|
By the way, you can check for OCSP stapling by running: If stapling is working, you'll see the string "OCSP Response Data" followed by a bunch of information. Otherwise, it will say "OCSP response: no response sent" |
|
This post leads me to suspect the same problem I had with TLSv1: it seems you have to specify OCSP stapling in the main server. Also, I was able to get the expired OCSP response to be stapled, but I couldn't get Firefox Stable or Nightly to fail on it. |
lgarron
force-pushed
the
master
branch
2 times, most recently
from
bf8408b to
a5da5f2
Compare
lgarron
force-pushed
the
master
branch
5 times, most recently
from
2665e91 to
585e425
Compare
lgarron
force-pushed
the
master
branch
2 times, most recently
from
6eb5e21 to
422f7cd
Compare
|
@AGWA Is there any news on this? I haven't tried your patch yet (merge conflicts), but let me know if any testing/help is needed. It'd be nice to have an end-point that serves a revoked OCSP response as well. |
lgarron
force-pushed
the
master
branch
5 times, most recently
from
52d267b to
b07e93f
Compare
lgarron
force-pushed
the
master
branch
2 times, most recently
from
7bd393a to
ce37f31
Compare
lgarron
force-pushed
the
master
branch
2 times, most recently
from
c47918b to
785c007
Compare
lgarron
force-pushed
the
master
branch
3 times, most recently
from
903cb3b to
5affce5
Compare
lgarron
force-pushed
the
master
branch
3 times, most recently
from
7d8ea9f to
ae0f2c8
Compare
lgarron
force-pushed
the
master
branch
3 times, most recently
from
1d2c736 to
8b893ec
Compare
lgarron
force-pushed
the
master
branch
2 times, most recently
from
1dfcd2b to
9ca20c0
Compare
This subdomain sends an expired stapled OCSP response, which triggers an SSL error in Firefox (and soon in Chrome as well).
The OCSP response, certs/wildcard.expired-ocsp.der, was generated by running:
where certs/wildcard.issuer.pem is a new file containing the certificate that issued certs/wildcard.normal.pem (i.e. the first intermediate certificate in the chain). http://ocsp.comodoca.com was taken from the OCSP field as output by
openssl x509 -in certs/wildcard.normal.pem -noout -text.certs/wildcard.expired-ocsp.der will need to be regenerated whenever wildcard.normal.pem is reissued.
Note that, at the time of this commit, certs/wildcard.expired-ocsp.der is not yet expired, but will expire on Jun 8, 2015 at 09:38:45 UTC. You may wish to defer merging this PR until this date passes.