Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix OCSP response handling errors with Let's Encrypt #4

Merged
merged 4 commits into from Jul 17, 2021
Merged

Fix OCSP response handling errors with Let's Encrypt #4

merged 4 commits into from Jul 17, 2021

Commits on Jul 10, 2021

  1. Use CFLAGS from apr-config, not apxs 

    Apxs adds flags from the Apache build it is from, and those might not
work in some cases, for example if a different compiler was used.
    @airtower-luna
    airtower-luna committed Jul 10, 2021
    Copy the full SHA
    3020716 View commit details
    Browse the repository at this point in the history

  2. SHA1 for issuer name hash and issuer key hash in OCSP requests 

    Some CAs (notably Let's Encrypt) support only SHA1. Support for that
is required by RFC 5019 [1] and referenced in CAB Forum Baseline
Requirements, too. This particular hash doesn't need to be
cryptographically secure, so switching to SHA1 is the simplest
solution.

[1] https://datatracker.ietf.org/doc/html/rfc5019#section-2.1.1
    @airtower-luna
    airtower-luna committed Jul 10, 2021
    Copy the full SHA
    c67643b View commit details
    Browse the repository at this point in the history

Commits on Jul 11, 2021

  1. Ensure the path part of OCSP URI isn't empty

    @airtower-luna
    airtower-luna committed Jul 11, 2021
    Copy the full SHA
    b8e9e11 View commit details
    Browse the repository at this point in the history

Commits on Jul 13, 2021

  1. Use the issuer certificate directly to verify OCSP responses 

    The detour over a trust list is unnecessary by using
gnutls_ocsp_resp_verify_direct(), which simplifies the code a lot, and
also avoids a current bug in gnutls_ocsp_resp_verify() [1].

[1] https://gitlab.com/gnutls/gnutls/-/issues/1254
    @airtower-luna
    airtower-luna committed Jul 13, 2021
    Copy the full SHA
    9c4ae9c View commit details
    Browse the repository at this point in the history