On resumed connections, the OCSP response and SCTs are dropped on the floor on the client-side. In the case of TLS 1.3, those parameters are available within the Certificate on the sessionStateTLS13 provided to the client, but just currently aren't being used. In the case of TLS 1.2, those parameters aren't included in the session state at all, since the certificates are just passed along as raw bytes. So fixing this for TLS 1.2 and earlier versions will require an update to the sessionState structure.
This will be particularly relevant now that 1.15 will include a VerifyConnection callback on the ConnectionState, which devs will use to access the OCSP responses and SCTs and do any necessary verification against them. Fixing this would be a stabilization fix for that new feature to align with user expectations.
/cc @FiloSottile
On resumed connections, the OCSP response and SCTs are dropped on the floor on the client-side. In the case of TLS 1.3, those parameters are available within the
Certificateon thesessionStateTLS13provided to the client, but just currently aren't being used. In the case of TLS 1.2, those parameters aren't included in the session state at all, since the certificates are just passed along as raw bytes. So fixing this for TLS 1.2 and earlier versions will require an update to thesessionStatestructure.This will be particularly relevant now that 1.15 will include a VerifyConnection callback on the ConnectionState, which devs will use to access the OCSP responses and SCTs and do any necessary verification against them. Fixing this would be a stabilization fix for that new feature to align with user expectations.
/cc @FiloSottile