CRL, OCSP and IPv6

[andrepereiradasilva]

Hi Ivan,

In the API docs you have «ocspStapling - true if OCSP stapling is deployed on the server»

But many CA's doesn't have OCSP IPv6 responders.
A nice list (probably outdated) in http://unmitigatedrisk.com/?p=147

So, reggarding this, if the server is:

• only IPv4: 'true' if if server as OCSP stapling is deployed and OCSP responder works with IPv4
• only IPv6: 'true' if if server as OCSP stapling is deployed and OCSP responder works with IPv6
• Dual stack (IPv4/IPv6): 'true' if server as OCSP stapling is deployed AND OCSP responder works with IPv4 and IPv6

Is this the result of the test? or ssl scan test doesn't test IPv6 OCSP?

A similiar case also for CRL in IPv6. For instance if a server is serving IPv6 and has a certificate from a CA with only IPv4 CRL, should this server be considered exceptional?

Also if a server has IPv6 shouldn't the endpoints IPv6 also be in the API JSON result (ex: "ipv6Address")?

Thanks

[ivanr]

Why is it relevant that a CA has IPv6 OCSP and CRL infrastructure?

[andrepereiradasilva]

For what i understand, when OCSP stapling is implemented the web server queries the OCSP server and the response is "stapled" in the tls handshake.

When OCSP stapling is configured in the server, if the server is pure IPv6 doesn't it try to communicate via IPv6 with the OCSP server? If so, if the server is IPv6 and the CA OCSP is only IPv4, it will not work, right? I don't see many cases for this now, but with IPv4 exaustion, i guess it will happen more in the future.

Also if a client only has IPv6? How will he connect to the OCSP server if it doesn't support IPv4?
The GlobalSign SSL Check Test (that i think is based on Qualys test), tests IPv6 OCSP support. They have an explanation why they do the test:
«We have detected that your site is available over IPv6 but your site's certificate contains references to servers that do not support IPv6. This means that despite your organization having done the work to support IPv6, users who can only communicate over IPv6 would experience errors when visiting your site.»
Source: https://sslcheck.globalsign.com/en/help/c15b8d74

I don't think it's a priority but it would be good to test OCSP IPv6 support in the future.
I see this like a feature for the future, not a bug.

[ivanr]

I understand. We don't test IPv6 at all now, but that should change soon. I'll consider this ticket then.

[andrepereiradasilva]

ivanr, another thing i remembered is that you can have the same server with SNI for IPv4 and without SNI for IPv6, since a provider can give one IPv4 and a lots of IPv6 for the same server, like DO for instance.
So i'm guessing if the IPv6 test shouldn't be considered an individual different endpoint.

[selecadm]

GlobalSign warns about CRL and OCSP inaccessibility over IPv6 primarily because their own servers support IPv6.

Comodo made the servers available over IPv6 on 15 February 2015.

Who else?

[andrepereiradasilva]

Yes, Globalsign and Comodo seem to be the only ones:
http://ip6.nl/#!ocsp.globalsign.com | http://ip6.nl/#!crl.globalsign.com
http://ip6.nl/#!ocsp.comodoca.com | http://ip6.nl/#!crl.comodoca.com

Entrust as some IPv6 capability, but doesn't seem to have full support
http://ip6.nl/#!ocsp.entrust.net | http://ip6.nl/#!crl.entrust.net

Don't know other that provides OCSP/CRL in IPv6.