9
votes
Accepted
Online Certificate Status Protocol (OCSP) and Port 80
OCSP does not have to be on port 80. However, the URL for the OCSP service is specified in the certificates whose validity you are checking; if you want to run it on another port, you need to make ...
7
votes
Accepted
Do Postfix and Dovecot support OCSP stapling?
As of 2017-10, No.
Dovecot does not have any OCSP support whatsoever, as of 2016 was considering the feature for a future release, no work has been done on that since.
Postfix does not have any OCSP ...
5
votes
Accepted
nginx: ssl_stapling_verify: What exactly is being verified?
I found in Nginx souce code. the file ngx_event_openssl_stapling.c#L660:
OCSP_basic_verify(basic, chain, store,staple->verify ? OCSP_TRUSTOTHER :OCSP_NOVERIFY
if you config `ssl_stapling_verify` ...
4
votes
Accepted
Can I make Nginx automatically OCSP staple certificates at reload/restart?
That article explains one way to do it:
https://matthiasadler.info/blog/ocsp-stapling-on-nginx-with-comodo-ssl/
The idea is to manually fetch de OCSP response and use the ssl_stapling_file directive.
...
4
votes
OpenSSL: how to setup an OCSP server for checking third-party certificates?
In case you are interested: here's my solution.
First I ditched OpenSSL's OCSP responder. It can't be used for certificates that have not been created with your self-signed CA.
Then I used the ...
3
votes
Accepted
OCSP setup for Vault
OCSP responder are not handled by Vault. The best you can do is set the URL to some custom OCSP responder calling Vault on the client's behalf with the ocsp_servers parameter in the same API call:
...
3
votes
Enabling OCSP stapling on IIS SNI-enabled site
According to Microsoft this behavior is disabled by default, because of potential performance issues.
To enable OCSP stapling for SNI and CCS bindings, locate the following registry subkey: "...
3
votes
Revoked certificate is still valid by Google Chrome and Microsoft Edge
Firefox checks CRLs, whereas Chrome/Chromium/Edge does not. The latter use CRLSets instead.
There is a good table at the bottom of this article. However it's 18 months old, and as browser security ...
3
votes
Accepted
Cannot enable OCSP stapling
In the images the properties of the certificate are shown. OCSP Must Staple is a property of the certificate, i.e. that the certificate should only be used together with OCSP stapling - see here for ...
2
votes
Accepted
OCSP Stapling on LAMP with Let's Encrypt
This is a short shell snippet that utilizes openssl:
openssl s_client -connect pavelstriz.cz:443 -tls1 -tlsextdebug -status |grep OCSP -A 2 -B 1
You should see something along:
OCSP Response ...
2
votes
Nginx letsencrypt OCSP stappling
nginx is fetching the OCSP response after the first time a request using the respective certificate was made.
This behaviour is probably going to be changed in order to fully support OCSP Must Staple
...
2
votes
Nginx letsencrypt OCSP stappling
I don't see anything wrong with your setup, but maybe removing the redundant resolver directive will yield a different result.
I've also faced a similar situation, and I've even tested OCSP stapling ...
2
votes
Accepted
Enabling OCSP stapling on IIS SNI-enabled site
Create a DWORD reg value EnableOcspStaplingForSni under HKLM\System\CurrentControlSet\Control\SecurityProviders\Schannel\ and set it to a non-zero value.
2
votes
Accepted
Why am I unable to make OCSP Stapling work with my nginx, libressl on FreeBSD 12.0-STABLE setup?
FreeBSD security/libressl was recently upgraded to 2.9.1. OCSP stapling has stopped working in nginx for me as well since the version change in LibreSSL, so I'm assuming there is an underlying issue ...
2
votes
Best approach to tier 2 PKI with multiple subordinates with ADCS
There is too little information in your initial question. But if you are looking for a clustered solution then keep in mind, that ADCS doesn't support load balancing. ADCS supports two-node server ...
2
votes
Accepted
How to check if a letsencrypt certificate has been revoked
Your input file contains two certificates: the leaf certificate first and the chain certificate second. The chain certificate is the issuer of the leaf certificate so it needs to be used for the -...
2
votes
Accepted
Apache httpd: How to enable OCSP stapling with mod_md?
It seems that in older versions of mod_md you have to use: <MDomainSet> if you make it a container directive. OCSP stapling however only made its appearance in mod_md version 2.1.0 and can only ...
2
votes
Accepted
Check OCSP on Linux with GET method
You need to add the -no_nonce option to OpenSSL.
Microsoft OCSP server doesn't support nonce in the requests.
1
vote
How to setup the OCSP responder
How to setup the OCSP responder?
Wikipedia lists several OSCP responder implementations here. Each server will have their own specific installation and configuration instructions.
For testing ...
1
vote
Accepted
How does OCSP handle deleted certificates?
Will the Microsoft OCSP Responder validate the serial number against the CA database as well as its revocation status?
by default, Microsoft OCSP will report such serial number as "Good". ...
1
vote
Accepted
Windows: How can I diagnose certificate revocation check failure, when I know the OK response is sent?
The certutil.exe has a relatively new option, called -downloadocsp which you can use to verify the OCSP responses.
In a command prompt, create two folders, called certs and results.
Place your ...
1
vote
How to check if a letsencrypt certificate has been revoked
Besides Steffen's answer using OCSP you can also use Certificate Transparency Logs search interfaces, that store all certificates, and their revocation status, from any public CA.
If you search with ...
1
vote
Accepted
"Next Update" is missing from the OCSP response
From section 4.2.2.1 of RFC 6960 - X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP:
If nextUpdate is not set, the responder is indicating that newer
revocation ...
1
vote
nginx: ssl_stapling_verify: What exactly is being verified?
Wikipedia says,
"OCSP stapling, formally known as the TLS Certificate Status Request extension, is an alternative approach to the Online Certificate Status Protocol (OCSP) for checking the revocation ...
1
vote
Using Apache as Stunnel
Turns out this was an error on my part in one the VirtualHost for 443.
This is what it looked like:
<VirtualHost *:443 *:7232>
# Configurations go here!
</VirtualHost>
Because ...
1
vote
Accepted
How to build an OCSP certificate chain for dual-stack RSA + ECC certificates
I did a quick research, and it seems the easiest answer to this "you don't build it" and it will just work :)
OSCP stapling may work fine without ssl_trusted certificate as long as..
Your OS trusted ...
1
vote
StrongswanPKI - Adding status_request or MustStaple TLS extension to certificate?
The X.509 extension you refer to is actually called "TLS feature extension" and is defined in RFC 7633. If defined, it contains a list of TLS extension identifiers of which one might be ...
1
vote
Accepted
Strongswan PKI - ED25519 Certifcates - OCSP Responder having issues
If you used strongSwan's pki tool to create your CA there won't be any index.txt file that OpenSSL needs for it's OCSP server. OpenSSL creates and modifies these index "database" files when issuing/...
1
vote
Accepted
nginx OCSP stapling centos let's encrypt
For anyone wondering...
ssl_stapling on;
ssl_trusted_certificate /etc/letsencrypt/live/DOMAIN/chain.pem;
#ssl_stapling_verify on;
note the hash, by having no verify it actually works:
on the ...
1
vote
Accepted
OCSP with nginx is unable to get issuer certificate
Thanks for all the comments! It made me look carefully at the certificate chains again and I noticed I did not put the root CA certificate into the file root_ca_and_intermediate.pem but the ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
ocsp × 66nginx × 21
ssl × 18
openssl × 17
ssl-certificate × 15
certificate-authority × 9
certificate × 7
pki × 7
crl × 7
security × 4
apache-2.4 × 4
iis × 4
windows × 3
strongswan × 3
ad-certificate-services × 3
ubuntu × 2
reverse-proxy × 2
x509 × 2
linux × 1
apache-2.2 × 1
windows-server-2008 × 1
ssh × 1
postfix × 1
windows-server-2003 × 1
windows-server-2008-r2 × 1