[openssl-users] OCSP response signed by self-signed trusted responder validation

[Animesh Patel (anipatel)]

Have a question with implementing an OCSP requestor that can handle validating an OCSP response that is not signed by the CA who issued the certificate that we are requesting the OCSP status for but rather, the OCSP response is signed by a self-signed trusted responder that includes the OCSP Signing EKU and the self-signed certificate is configured as trusted on the requesting system.

Question is how to get past the check in OCSP_basic_verify() that calls ocsp_check_issuer() with the responder chain and fails in ocsp_match_issuerid() since the issuer ID doesn’t match the self-signed responder certificate ID causing the verify to fail with ‘OCSP routines:OCSP_basic_verify:root ca not trusted in ocsp_vfy.c line 176.’

Could someone please shed light on how this is expected to work for this scenario?  Is it expected that the self-signed certificate needs to be added to have explicit trust so that it is allowed via the call to X509_check_trust() or is there something else I’m missing here?

Thanks,
Animesh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20181204/3d894c87/attachment-0001.html>