Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upAdd expired-ocsp.badssl.com subdomain #54
Conversation
|
Thanks for the PR! Also, could you explain how I could make this work for a real |
I'll look into that. It may be tricky because it will require generating an OCSP response off of the testing intermediate, and the
I think there was a misunderstanding - this is meant to work with the real *.badssl.com cert - the OCSP response I committed is signed by Comodo and is for the actual *.badssl.com cert in production. My commit message was probably unclear about |
|
I see. I haven't worked much with OCSP. I that case, adding something to the script would be preferable – the cert generator should give you the intermediate. In either case, I'll wait until the 8th to merge. Thanks for the explanation. |
AGWA
force-pushed the
AGWA-forks:master
branch
2 times, most recently
from
27e3830
to
18eaf58
|
I just amended the PR to:
|
This subdomain sends an expired stapled OCSP response, which triggers an SSL error in Firefox (and soon in Chrome as well). The OCSP response, certs/wildcard.expired-ocsp.der, was generated by running: openssl ocsp -issuer certs/wildcard.issuer.pem -cert certs/wildcard.normal.pem -url http://ocsp.comodoca.com -noverify -respout certs/wildcard.expired-ocsp.der where certs/wildcard.issuer.pem contains the certificate that issued certs/wildcard.normal.pem (i.e. the first intermediate certificate in the chain). http://ocsp.comodoca.com was taken from the OCSP field as output by `openssl x509 -in certs/wildcard.normal.pem -noout -text`. certs/wildcard.expired-ocsp.der will need to be regenerated whenever wildcard.normal.pem is reissued. Note that, at the time of this commit, certs/wildcard.expired-ocsp.der is not yet expired, but will expire on Jun 8, 2015 at 09:38:45 UTC.
|
Excellent, thanks! Deterministic serial numbers sound fine to me. @marumari: As official definite responsible authoritative If not, I'll merge this on the 9th. |
|
@AGWA I've tried a handful of times, but can't seem to get https://expired-ocsp.badssl.com/ to fail (in Firefox or Chrome). Am I missing something? |
|
@lgarron Hmmm... it's not serving up the stapled OCSP response. Do you see anything in the nginx error log about stapling? |
|
By the way, you can check for OCSP stapling by running: If stapling is working, you'll see the string "OCSP Response Data" followed by a bunch of information. Otherwise, it will say "OCSP response: no response sent" |
|
This post leads me to suspect the same problem I had with TLSv1: it seems you have to specify OCSP stapling in the main server. Also, I was able to get the expired OCSP response to be stapled, but I couldn't get Firefox Stable or Nightly to fail on it. |
lgarron
force-pushed the
chromium:master
branch
2 times, most recently
from
bf8408b
to
a5da5f2
lgarron
force-pushed the
chromium:master
branch
5 times, most recently
from
2665e91
to
585e425
lgarron
force-pushed the
chromium:master
branch
2 times, most recently
from
6eb5e21
to
422f7cd
ghedo
commented
Jan 13, 2016
|
@AGWA Is there any news on this? I haven't tried your patch yet (merge conflicts), but let me know if any testing/help is needed. It'd be nice to have an end-point that serves a revoked OCSP response as well. |
lgarron
force-pushed the
chromium:master
branch
5 times, most recently
from
52d267b
to
b07e93f
lgarron
force-pushed the
chromium:master
branch
2 times, most recently
from
7bd393a
to
ce37f31
lgarron
force-pushed the
chromium:master
branch
2 times, most recently
from
c47918b
to
785c007
lgarron
force-pushed the
chromium:master
branch
3 times, most recently
from
903cb3b
to
5affce5
lgarron
force-pushed the
chromium:master
branch
3 times, most recently
from
7d8ea9f
to
ae0f2c8
lgarron
force-pushed the
chromium:master
branch
3 times, most recently
from
1d2c736
to
8b893ec
lgarron
force-pushed the
chromium:master
branch
2 times, most recently
from
1dfcd2b
to
9ca20c0
AGWA commentedJun 4, 2015
This subdomain sends an expired stapled OCSP response, which triggers an SSL error in Firefox (and soon in Chrome as well).
The OCSP response, certs/wildcard.expired-ocsp.der, was generated by running:
where certs/wildcard.issuer.pem is a new file containing the certificate that issued certs/wildcard.normal.pem (i.e. the first intermediate certificate in the chain). http://ocsp.comodoca.com was taken from the OCSP field as output by
openssl x509 -in certs/wildcard.normal.pem -noout -text.certs/wildcard.expired-ocsp.der will need to be regenerated whenever wildcard.normal.pem is reissued.
Note that, at the time of this commit, certs/wildcard.expired-ocsp.der is not yet expired, but will expire on Jun 8, 2015 at 09:38:45 UTC. You may wish to defer merging this PR until this date passes.