Verification failure on many popular sites

[benturner]

Hi @indutny, this lib is great, but I'm having lots of trouble verifying OCSP on some popular sites. I was wondering if you had any idea what is different between the cert setup in the success cases versus the failure cases of this simple script:

'use strict';

const ocsp = require('ocsp');
const https = require('https');

const agent = new ocsp.Agent();

function go(host) {
  const req = https.request({host: host, agent: agent}, (res) => {
    console.log(host, res.statusCode);
  });
  req.on('error', (error) => {
    console.error(host, error);
  });
  req.end();
}

go('google.com');
go('yahoo.com');
go('nytimes.com');
go('microsoft.com');

Running this script produces the following:

$ node ocsp.js 
nytimes.com 301
yahoo.com Error: Invalid signature
    at Object.verify (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/verify.js:50:17)
    at onIssuer (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/agent.js:93:12)
    at Agent.handleOCSPResponse (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/agent.js:103:12)
    at TLSSocket.<anonymous> (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/agent.js:52:17)
    at emitNone (events.js:91:20)
    at TLSSocket.emit (events.js:185:7)
    at TLSSocket._finishInit (_tls_wrap.js:603:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:433:38)
microsoft.com Error: Invalid signature
    at Object.verify (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/verify.js:50:17)
    at onIssuer (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/agent.js:93:12)
    at Agent.handleOCSPResponse (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/agent.js:103:12)
    at TLSSocket.<anonymous> (/Users/bent/src/test/node_modules/ocsp/lib/ocsp/agent.js:52:17)
    at emitNone (events.js:91:20)
    at TLSSocket.emit (events.js:185:7)
    at TLSSocket._finishInit (_tls_wrap.js:603:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:433:38)
google.com 301

[benturner]

openssl seems happy enough with these sites, by the way.

[indutny]

Should be fixed now, sorry!

[benturner]

Thanks!