OCSP stapling broken in Nginx with v2.9.1

[sephiroth-j]

When building Nginx 1.15.x, 1.16.0 or 1.17.0 with LibreSSL v2.9.1, OCSP stapling with Let's Encrypt (and others?) does not work anymore because the signer certificate could not be found. LibreSSL v2.9.0 is fine.

The nginx error message is:
OCSP_basic_verify() failed (SSL: error:27FFF076:OCSP routines:CRYPTO_internal:signer certificate not found) while requesting certificate status, responder: ocsp.int-x3.letsencrypt.org, peer: 95.101.72.151:80, certificate: "/path/to/fullchain.pem"

The output of openssl s_client -status [...] contains OCSP response: no response sent.

related Nginx config

ssl_stapling            on;
ssl_stapling_verify     on;
resolver		8.8.8.8;
ssl_certificate_key     /path/to/privkey.pem;
ssl_certificate         /path/to/fullchain.pem;
ssl_trusted_certificate /path/to/chain.pem;

p.s.
OCSP_basic_verify is called here

[AliceWonderMiscreations]

It does work in 2.9.2 with apache so might this be nginx that needs a patch? I don't use nginx so I am not able to test it against my build of LibreSSL.

OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
    Produced At: May 25 22:27:00 2019 GMT

[kinichiro]

Here is another report.
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237757

LibreSSL was forked from OpenSSL 1.0.1 and SSL_CTX_get_extra_chain_certs() returned extra_certs at that time.
It appears that OpenSSL 1.0.2 had changed the behavior of SSL_CTX_get_extra_chain_certs() and added SSL_CTX_get_extra_chain_certs_only() that returns extra_certs.
I think SSL_CTX_get_extra_chain_certs() has different functionality between LibreSSL and OpenSSL, now.

[concatime]

Same issue.

While I generally like LibreSSL, this looks like a LibreSSL bug to
me. And instead of trying to fix working code in nginx, you may
want to focus on fixing SSL_CTX_get_extra_chain_certs() in
LibreSSL.

from http://mailman.nginx.org/pipermail/nginx-devel/2019-May/012212.html

• http://mailman.nginx.org/pipermail/nginx-ru/2019-May/062150.html
• https://forum.nginx.org/read.php?21,284203,284217#msg-284217

[concatime]

Bug persists on 3.0.0.

[mundschenk-at]

It's unfortunate that LibreSSL changed its behavior here :(

[mattieub]

I confirm the bug is also present on OpenBSD, since 6.5.
OCSP stapling fails with Nginx.

[4a6f656c]

The behavior of SSL_CTX_get_extra_chain_certs() has been revised to match OpenSSL in
openbsd/src@8c9e35f