ocsp proxy support feature request

[plaintextcity]

Proxy support in s_client is a welcome addition and helpful for troubleshooting. In order to troubleshoot connection issues (walking through Ivan Ristic's OpenSSL Cookbook "Testing with OpenSSL") it would be helpful to have the equivalent -proxy support from s_client in ocsp.

[DanielOatAWS]

Ping. Can you please confirm that 'ocsp' module cannot work behind a proxy, and if so, maybe see about prioritising this feature request (if possible at all)?

[t8m]

@DDvO is this somehow handled already in your http client improvements in the current master?

[DDvO]

So far I was not aware of this FR; thanks @t8m for pointing me to it.

I've added proxy support to the OpenSSL crypto lib already 1.5 years ago in PR #10667 (commit 29f178b).
This was driven by supporting HTTP(S) proxies for CMP, but this way HTTP(S) proxies were already implicitly usable for the ocsp and s_server apps by setting the environment variables http_proxy etc.
It would be straightforward to make explicit use of this for both these CLI apps.

Yet I wonder if this FR makes sense for the s_client app - does this use (classical/plain) OCSP at all, where an HTTP(S) proxy can be of interest?
For s_client I can see only the optional use of OCSP stapling (i.e., the TLS cert status extension),
which reuses the (TCP, HTTP or whatever) connection itself for which TLS is being set up.

[DDvO]

I just added explicit HTTP(S) proxy support to the OCSP client part of the ocsp and s_server apps in #15245.
Is that what was actually desired in this FR?

[DDvO]

@plaintextcity, @ounsworth, @THausherr, @DanielOatAWS, and @drwetter, did #15245 solve the issue for you?

[drwetter]

To me it seems so. Thanks!

[THausherr]

I can't comment, I'm not sure why I bookmarked this. Most likely I had to troubleshoot some https connection at work years ago.

[DDvO]

I can't comment, I'm not sure why I bookmarked this. Most likely I had to troubleshoot some https connection at work years ago.

Thanks anyway for letting us know.

[ounsworth]

@DDvO Neat, I had forgotten about this thread.

If I remember correctly, at the time I was fuzz testing an OCSP server and I was looking for an easy way to capture valid OCSP requests in a proxy like Burp or OWASP ZAP so that I could then inject broken ASN.1.

I would be happy to test this, but I've never done openssl dev before, so I'll need instructions for getting the nightly build or building your dev branch.

[DDvO]

@DDvO Neat, I had forgotten about this thread.

If I remember correctly, at the time I was fuzz testing an OCSP server and I was looking for an easy way to capture valid OCSP requests in a proxy like Burp or OWASP ZAP so that I could then inject broken ASN.1.

Interesting use case.
So apparently you were using the OCSP client portion of the ocsp app.
For this the -proxy option should have helped.

I would be happy to test this, but I've never done openssl dev before, so I'll need instructions for getting the nightly build or building your dev branch.

Thanks @ounsworth for offering to test this.
According to what we just wrote above, I'm confident that the fix would have helped,
so I don't see the need for testing with your use case.
If you still wanna try it out, you could take yesterday's alpha release from https://www.openssl.org/source/,
which can be built as usual.

[t8m]

I am closing this. A new issue can be opened if there is still anything missing with the proxy support in ocsp.