[openssl-users] OCSP verification issue

[Peter Bowen]

I recently ran into a bug with verification of OCSP responses that appears to be in all versions of OpenSSL (including current 1.1.0 builds).

RFC 6960 and its predecessor 2560 allow that the response may be signed by the key for "the CA who issued the certificate in question” (section 2.2).  In this case it should not be necessary to include any certs in the basicResponse, as the signature can be validated using the public key used to validate the certificate whose status is being checked.

While this is contemplated by the RFCs, OpenSSL fails in certain cases if no certificates are provided in the response. If there are at least two intermediate CAs in the certificate chain between a trust anchor and end entity certificate, then OCSP_basic_verify will return a certificate verify error.

The code below reproduces the failure and demonstrates that reducing the path length from anchor to end entity certificate resolves the issue as does adding a certificate from the trust anchor to the first CA to the response.

I think the correct behaviour would be to check if the issuer of the certificate matches the signer of the OCSP response and, if so, simply skip the X509_verify_cert check.

Thanks,
Peter

#!/usr/bin/env ruby
# Copyright 2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html

require 'openssl'
require 'base64'
require 'open3'

# Ruby has no to_text method for OCSP responses, so shell out
def ocsp_to_text(ocsp_der)
  # Figure out if our base64 uses -D or -d to decode
  %x/echo | base64 -D/
  if $? == 0
    dparam="-D"
  else
    dparam="-d"
  end

  out = ""
  Open3::popen2("/bin/bash -t") do |i, o, t|
    i.puts("openssl ocsp -noverify -text -respin <(echo #{Base64.strict_encode64(ocsp_der)} | base64 #{dparam})")
    o.each{|l|out += l}
  end
  out
end

# Set up Names and Keys for all the certs
nodes = {
  :root => {
    :name => OpenSSL::X509::Name.new([["C", "US", OpenSSL::ASN1::PRINTABLESTRING],
              ["O", "Beyond Hypersecure Inc", OpenSSL::ASN1::PRINTABLESTRING],
              ["CN", "Beyond Hypersecure Root CA", OpenSSL::ASN1::PRINTABLESTRING]]),
    :key => OpenSSL::PKey::RSA.new(2048)
  },
  :ca1 => {
    :name => OpenSSL::X509::Name.new([["C", "US", OpenSSL::ASN1::PRINTABLESTRING],
              ["O", "Beyond Hypersecure Inc", OpenSSL::ASN1::PRINTABLESTRING],
              ["CN", "Beyond Hypersecure Partner CA", OpenSSL::ASN1::PRINTABLESTRING]]),
    :key => OpenSSL::PKey::RSA.new(2048)
  },
  :ca2 => {
    :name => OpenSSL::X509::Name.new([["C", "US", OpenSSL::ASN1::PRINTABLESTRING],
              ["O", "HyperCyberHost LLC", OpenSSL::ASN1::PRINTABLESTRING],
              ["CN", "HyperCyberHost Server CA", OpenSSL::ASN1::PRINTABLESTRING]]),
    :key => OpenSSL::PKey::RSA.new(2048)
  },
  :ee => {
    :name => OpenSSL::X509::Name.new([["C", "US", OpenSSL::ASN1::PRINTABLESTRING],
              ["CN", "localdemo.sslmap.com", OpenSSL::ASN1::PRINTABLESTRING]]),
    :key => OpenSSL::PKey::RSA.new(2048),
    :sans => "DNS:localdemo.sslmap.com"
  }
}

# Generate all the certs
root_cert = OpenSSL::X509::Certificate.new
root_cert.version = 0x2
root_cert.serial = 0x0
root_cert.not_before = Time.new(2004,01,01,00,00,01)
root_cert.not_after =  Time.new(2028,12,31,23,59,59)
root_cert.subject = nodes[:root][:name]
root_cert.issuer = root_cert.subject
root_cert.public_key = nodes[:root][:key]
ef = OpenSSL::X509::ExtensionFactory.new
ef.subject_certificate = root_cert
ef.issuer_certificate = root_cert
root_cert.add_extension(ef.create_extension("subjectKeyIdentifier", "hash", false))
root_cert.add_extension(ef.create_extension("basicConstraints", "CA:TRUE", true))
root_cert.add_extension(ef.create_extension("keyUsage","digitalSignature, keyCertSign, cRLSign", true))
root_cert.sign(nodes[:root][:key], OpenSSL::Digest::SHA256.new)

puts root_cert.to_text
puts root_cert.to_pem

ca1_cert = OpenSSL::X509::Certificate.new
ca1_cert.version = 0x2
ca1_cert.serial = 0xa
ca1_cert.not_before = Time.new(2011,01,01,00,00,01)
ca1_cert.not_after =  Time.new(2020,12,31,23,59,59)
ca1_cert.subject = nodes[:ca1][:name] 
ca1_cert.issuer = root_cert.subject
ca1_cert.public_key = nodes[:ca1][:key]
ef = OpenSSL::X509::ExtensionFactory.new
ef.config = OpenSSL::Config.parse('
[polsect]
policyIdentifier = 2.5.29.32.0
CPS.1="http://beyondhypersecure.example.com/cps"
')
ef.subject_certificate = ca1_cert
ef.issuer_certificate = root_cert
ca1_cert.add_extension(ef.create_extension("subjectKeyIdentifier", "hash", false))
ca1_cert.add_extension(ef.create_extension("authorityKeyIdentifier", "keyid:always", false))
ca1_cert.add_extension(ef.create_extension("basicConstraints", "CA:TRUE", true))
ca1_cert.add_extension(ef.create_extension("certificatePolicies","2.5.29.32.0"))
ca1_cert.add_extension(ef.create_extension("keyUsage","digitalSignature, keyCertSign, cRLSign", true))
ca1_cert.add_extension(ef.create_extension("authorityInfoAccess","caIssuers;URI:http://beyondhypersecure.example.com/root.cer,OCSP;URI:http://ocsp.beyondhypersecure.example.com"))
ca1_cert.add_extension(ef.create_extension("crlDistributionPoints","URI:http://beyondhypersecure.example.com/root.crl"))
ca1_cert.sign(nodes[:root][:key], OpenSSL::Digest::SHA256.new)

puts ca1_cert.to_text
puts ca1_cert.to_pem

ca2_cert = OpenSSL::X509::Certificate.new
ca2_cert.version = 0x2
ca2_cert.serial = 0xfb
ca2_cert.not_before = Time.new(2012,01,01,00,00,01)
ca2_cert.not_after =  Time.new(2018,12,31,23,59,59)
ca2_cert.subject = nodes[:ca2][:name] 
ca2_cert.issuer = ca1_cert.subject
ca2_cert.public_key = nodes[:ca2][:key]
ef = OpenSSL::X509::ExtensionFactory.new
ef.config = OpenSSL::Config.parse('
[polsect]
policyIdentifier = 2.5.29.32.0
CPS.1="http://beyondhypersecure.example.com/cps"
')
ef.subject_certificate = ca2_cert
ef.issuer_certificate = ca1_cert
ca2_cert.add_extension(ef.create_extension("subjectKeyIdentifier", "hash", false))
ca2_cert.add_extension(ef.create_extension("authorityKeyIdentifier", "keyid:always", false))
ca2_cert.add_extension(ef.create_extension("basicConstraints", "CA:TRUE", true))
ca2_cert.add_extension(ef.create_extension("certificatePolicies","2.5.29.32.0"))
ca2_cert.add_extension(ef.create_extension("keyUsage","digitalSignature, keyCertSign, cRLSign", true))
ca2_cert.add_extension(ef.create_extension("authorityInfoAccess","caIssuers;URI:http://beyondhypersecure.example.com/ca1.cer,OCSP;URI:http://ocsp.beyondhypersecure.example.com"))
ca2_cert.add_extension(ef.create_extension("crlDistributionPoints","URI:http://beyondhypersecure.example.com/ca1.crl"))
ca2_cert.sign(nodes[:ca1][:key], OpenSSL::Digest::SHA256.new)

puts ca2_cert.to_text
puts ca2_cert.to_pem

ee_cert = OpenSSL::X509::Certificate.new
ee_cert.version = 0x2
ee_cert.serial = OpenSSL::BN.rand(64, -1, 0)
ee_cert.not_before = Time.new(2015,02,26,16,00,00)
ee_cert.not_after =  Time.new(2016,02,28,15,59,59)
ee_cert.subject = nodes[:ee][:name]
ee_cert.issuer = ca2_cert.subject
ee_cert.public_key = nodes[:ee][:key]
ef = OpenSSL::X509::ExtensionFactory.new
ef.config = OpenSSL::Config.parse('
[polsect]
policyIdentifier = 2.23.140.1.2.1
CPS.1="http://beyondhypersecure.example.com/cps"
')
ef.subject_certificate = ee_cert 
ef.issuer_certificate = ca2_cert
ee_cert.add_extension(ef.create_extension("authorityKeyIdentifier", "keyid:always", false))
ee_cert.add_extension(ef.create_extension("certificatePolicies","@polsect"))
ee_cert.add_extension(ef.create_extension("subjectAltName",nodes[:ee][:sans]))
ee_cert.add_extension(ef.create_extension("keyUsage","digitalSignature,keyEncipherment", true))
ee_cert.add_extension(ef.create_extension("extendedKeyUsage", "serverAuth, clientAuth"))
ee_cert.add_extension(ef.create_extension("crlDistributionPoints","URI:http://beyondhypersecure.example.com/ca2.crl"))
ee_cert.add_extension(ef.create_extension("authorityInfoAccess","caIssuers;URI:http://beyondhypersecure.example.com/ca2.cer,OCSP;URI:http://ocsp.beyondhypersecure.example.com"))
ee_cert.sign(nodes[:ca2][:key], OpenSSL::Digest::SHA256.new)

puts nodes[:ee][:key].to_text
puts nodes[:ee][:key].to_pem

puts ee_cert.to_text
puts ee_cert.to_pem

bres = OpenSSL::OCSP::BasicResponse.new
cid = OpenSSL::OCSP::CertificateId.new(ee_cert, ca2_cert, OpenSSL::Digest::SHA1.new)
bres.add_status(cid, OpenSSL::OCSP::V_CERTSTATUS_GOOD, 0, nil, -1*60*60*6, 60*60*24*3, [])
bres.sign(ca2_cert, nodes[:ca2][:key], nil, OpenSSL::OCSP::RESPID_KEY)
ocsp_res = OpenSSL::OCSP::Response.create(OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, bres)
ocsp_res_1_der = ocsp_res.to_der

puts ocsp_to_text(ocsp_res_1_der)
puts "-----BEGIN OCSP RESPONSE 1-----"
puts Base64.encode64(ocsp_res_1_der)
puts "-----END OCSP RESPONSE 1-----"

bres.sign(ca2_cert, nodes[:ca2][:key], [ca1_cert], OpenSSL::OCSP::RESPID_KEY)
ocsp_res = OpenSSL::OCSP::Response.create(OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, bres)
ocsp_res_2_der = ocsp_res.to_der

# OCSP_basic_sign adds the signer cert unless OCSP_NOCERTS is passed
# Ruby doesn't expose OCSP_basic_add1_cert, so instead we rip out the signer
# cert, just leaving the certs we explicitly passed to OCSP_basic_sign
# (Yes, this is a horrible hack)
a = OpenSSL::ASN1.decode(ocsp_res_2_der)
bres_a = OpenSSL::ASN1.decode(a.value[1].value[0].value[1].value)
bres_a.value[3].value[0].value.delete_at(0)
a.value[1].value[0].value[1].value = bres_a.to_der
ocsp_res_2_der = a.to_der

puts ocsp_to_text(ocsp_res_2_der)
puts "-----BEGIN OCSP RESPONSE 2-----"
puts Base64.encode64(ocsp_res_2_der)
puts "-----END OCSP RESPONSE 2-----"

## Now test

# Encode/decode loops to ensure the client test objects are clean
trust_store_1 = OpenSSL::X509::Store.new
[root_cert].each do |c|
  trust_store_1.add_cert(OpenSSL::X509::Certificate.new(c.to_der))
end

trust_store_2 = OpenSSL::X509::Store.new
[root_cert, ca1_cert].each do |c|
  trust_store_2.add_cert(OpenSSL::X509::Certificate.new(c.to_der))
end

server_chain = [ee_cert, ca2_cert, ca1_cert].map{|c|OpenSSL::X509::Certificate.new(c.to_der)}

ocsp_res_1 = OpenSSL::OCSP::Response.new(ocsp_res_1_der)
ocsp_res_2 = OpenSSL::OCSP::Response.new(ocsp_res_2_der)

puts "\nTrying with only root cert in trust store"
puts ocsp_res_1.basic.verify(server_chain, trust_store_1)

puts "\nTrying with root and issuer of CA cert in trust store"
puts ocsp_res_1.basic.verify(server_chain, trust_store_2)

puts "\nTrying with only root cert in trust store and with CA1 cert in response"
puts ocsp_res_2.basic.verify(server_chain, trust_store_1)

puts "\nTrying with root and issuer of CA cert in trust store and with CA1 cert in response"
puts ocsp_res_2.basic.verify(server_chain, trust_store_2)