Am trying to set up OCSP validation routines, and so want to be comfortable with the environment first. Found excellent tutorials at for example OpenSSL: Manually verify a certificate against an OCSP.
Multiple questions arise, so please bear with me.
There have been some changes since that tutorial, but I think the gist is:
1) snag the certificate you want to verify, e.g.
openssl s_client -connect wikipedia.org:443 2>&1 < /dev/null | sed -n '/-----BEGIN/,/-----END/p' > wikipedia.pem
2) build the certificate chain, e.g.
openssl s_client -connect wikipedia.org:443 -showcerts 2>&1 < /dev/null > chain.pem
and then edit appropriately. I found that the above doesn't provide the self-signed CA certificate, GlobalSignRootCA, so added that in.
3) Determine the ocsp URI, e.g.
openssl x509 -noout -ocsp_uri -in wikipedia.pem
which returns
http://ocsp2.globalsign.com/gsorganizationvalsha2g2
4) Invoke the openssl ocsp client, e.g.
openssl ocsp -issuer chain.pem -cert wikipedia.pem -url http://ocsp2.globalsign.com/gsorganizationvalsha2g2
which returns
[woody@oc2042275410 testCerts]$ openssl ocsp -issuer chain.pem -cert wikipedia.pem -url http ://ocsp2.globalsign.com/gsorganizationvalsha2g2
Error querying OCSP responsder
140062843348808:error:27076072:OCSP routines:PARSE_HTTP_LINE1:server response error:ocsp_ht.c:250:Code=403,Reason=Forbidden
(responsder?)
I read that this is due to a virtualization issue, so
openssl ocsp -issuer chain.pem -cert wikipedia.pem -url http://ocsp2.globalsign.com/gsorganizationvalsha2g2 -header "HOST" "ocsp2.globalsign.com"
which yields
Response Verify Failure
140400906352456:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:126:Verify error:unable to get local issuer certificate
wikipedia.pem: good
This Update: Apr 28 23:10:10 2015 GMT
Next Update: Apr 29 11:10:10 2015 GMT
So I'm getting that the OCSP returned that the cert is good, but this leads to question 1: why the error 'unable to get local issuer certificate'?
Ok, trying again with Google. Same routine, capturing cert, checking for OCSP URI:
openssl x509 -noout -ocsp_uri -in google.pem
yields
http://clients1.google.com/ocsp.
Fair enough:
openssl ocsp -issuer gchain.pem -cert google.pem -url http://clients1.google.com/ocsp
Error querying OCSP responsder
140433209165640:error:27076072:OCSP routines:PARSE_HTTP_LINE1:server response error:ocsp_ht.c:250:Code=404,Reason=Not Found
Not Found? That seemed surprising. Checking with wireshark:
> POST /ocsp HTTP/1.0
> Content-Type: application/ocsp-request
> Content-Length: 112
> 0n0l0E0C0A0...+..........j.....p.I.#z...(~d...U.. [.5...J:.......l..9.....{6.#0!0...+.....0......].O.9..}d`.L...
< ~HTTP/1.0 404 Not Found
< Content-Type: text/html; charset=UTF-8
< X-Content-Type-Options: nosniff
< Date: Tue, 28 Apr 2015 22:42:40 GMT
< Server: sffe
< Content-Length: 1429
< X-XSS-Protection: 1; mode=block
< Alternate-Protocol: 80:quic,p=1
<
< <!DOCTYPE html>
< <html lang=en>
< <meta charset=utf-8>
< <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
< <title>Error 404 (Not Found)!!1</title>
< <style>
< *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/errors/logo_sm_2.png) no-repeat}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/errors/logo_sm_2_hr.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/errors/logo_sm_2_hr.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/errors/logo_sm_2_hr.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:55px;width:150px}
< </style>
< <a href=//www.google.com/><span id=logo aria-label=Google></span></a>
< <p><b>404.</b> <ins>That...s an error.</ins>
< <p>The requested URL <code>/ocsp</code> was not found on this server. <ins>That...s all we know.</ins>
So that is question 2: is this correct, the OCSP was moved, and isn't present at the OCSP URI? Is it perhaps that the server has uniformly moved to OCSP stapling, and doesn't consider the OCSP server important any longer?
