full-chain ocsp stapling

[Jeremy Harris]

On 01/10/2019 12:21, Jeremy Harris wrote:
> On 30/09/2019 17:02, Matt Caswell wrote:
>>> Alternatively^2, is there some way to get such a blob from a tool 
>>> (openssl ocsp, or similar) ready built?   For this purpose, I am 
>>> the CA.
>>>
>>
>> Yes, you can do this. For example see the "respout" option in the 
>> ocsp command.
>>
>> From the examples in the ocsp man page:
>>
>> Send a query to an OCSP responder with URL http://ocsp.myhost.com/ 
>> save the response to a file, print it out in text form, and verify 
>> the response:
>>
>> openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \ -url 
>> http://ocsp.myhost.com/ -resp_text -respout resp.der
> 
> I'm using the indexfile variant.  It seems that the -CA argument
> needs to be the signer of the cert, not the CA for the chain; and
> you cannot give -CA multiple times.  So you don't get good OCSP status
> for all elements in the chain:
> 
> $ cat $ifile
> V       130110200751Z           65      unknown CN=server1.example.com
> V       130110200751Z           66      unknown CN=revoked1.example.com
> V       130110200751Z           67      unknown CN=expired1.example.com
> V       130110200751Z           c9      unknown CN=server2.example.com
> V       130110200751Z           ca      unknown CN=revoked2.example.com
> V       130110200751Z           cb      unknown CN=expired2.example.com
> V       130110200751Z           42      unknown CN=clica Signing Cert rsa
> V       130110200751Z           41      unknown CN=clica CA rsa
> $
> $ openssl ocsp -sha256 -no_nonce -issuer $CADIR/Signer.pem -cert
> $leafcert -issuer $CADIR/CA.pem -cert $CADIR/Signer.pem -cert
> $CADIR/CA.pem -reqout $REQ -req_text
> OCSP Request Data:
>     Version: 1 (0x0)
>     Requestor List:
>         Certificate ID:
>           Hash Algorithm: sha256
>           Issuer Name Hash:
> 5AF082E51D62FE01FD706BAEBEB878DB64E68F76E74A36F36D914297DDEE24B8
>           Issuer Key Hash:
> 333DB14364B98E78A33DD8A4FAE8D8378EA9B0F5FBCA97B25685AA0D32116091
>           Serial Number: 65
>         Certificate ID:
>           Hash Algorithm: sha256
>           Issuer Name Hash:
> BFA7275A566EFD4BE2DF82DBD9D1290D470186F6FF2ACD8C16659F342AB56109
>           Issuer Key Hash:
> 208F9D28C7C0BC914144DFA8C0BE3D5B3BFCEBB622C8A8DC27E865FC06CA0E12
>           Serial Number: 42
>         Certificate ID:
>           Hash Algorithm: sha256
>           Issuer Name Hash:
> BFA7275A566EFD4BE2DF82DBD9D1290D470186F6FF2ACD8C16659F342AB56109
>           Issuer Key Hash:
> 208F9D28C7C0BC914144DFA8C0BE3D5B3BFCEBB622C8A8DC27E865FC06CA0E12
>           Serial Number: 41
> $
> $ openssl ocsp -index $ifile -rsigner $CADIR/CA.pem -rkey $CADIR/CA.key
> -CA $CADIR/CA.pem -resp_no_certs -noverify         -ndays 3652 -reqin
> $REQ -respout $RESP -resp_text | egrep '(Serial|Status)'
>     OCSP Response Status: successful (0x0)
>       Serial Number: 65
>     Cert Status: unknown
>       Serial Number: 42
>     Cert Status: good
>       Serial Number: 41
>     Cert Status: good
> $
> 
> 

No answers on how to get ocsp responses for all elements of a
certificate chain?

-- 
Cheers,
  Jeremy