Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am testing the Certificate Revocation functionality of a CMTS device. This requires me to setup a OCSP responder. Since it will only be used for testing I assume that the minimal implementation provided by OpenSSL should suffice.

I have extracted the a certificate from a cable modem, copied it to my PC and converted it to the PEM format. Now I want to register it in the OpenSSL OCSP database and start a server.

I have completed all these steps, but when I do a client request my server invariably responds with "unknown". It seems to be completely unaware of my certificate's existence.

I would greatly appreciate if anyone would be willing to have a look at my code. For your convenience, I have created a single script consisting of a sequential list of all used commands, from setting up the CA until starting the server: http://code.google.com/p/stacked-crooked/source/browse/trunk/Misc/OpenSSL/AllCommands.sh

You can also find the custom config file and the certificate that I am testing with: http://code.google.com/p/stacked-crooked/source/browse/trunk/Misc/OpenSSL/

Any help would be greatly appreciated.


In case you are interested: here's my solution.

First I ditched OpenSSL's OCSP responder. It can't be used for certificates that have not been created with your self-signed CA.

Then I used the OpenCA libraries to create a command line utility that is capable of creating an OCSP response from an OSCP request. It works entirely file-based: you run it with a DER formatted OSCP request as input file, and it outputs a DER formatted OCSP response file.

A second argument to the command line utility is the revocation status: good, revoked or unknown. The certificate status in the response file will be the same as the passed argument. The code is based on this sample, pointed out to me by The Rook in this post.

The final step was to create a HTTP server that builds upon the command line utility. I used Ruby's Merb framework for that. A nifty feature is that the revocation status can be requested as a HTTP url, for example:

share|improve this question

migrated from superuser.com Apr 13 '10 at 15:24

This question came from our site for computer enthusiasts and power users.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.