Skip to content

WIP: OpenSSL: OCSP support

Ander Juaristi requested to merge wget2-openssl-ajuaristi-ocsp into master

Here comes, finally the OCSP implementation with the OpenSSL backend.

It's basically working, passes all the tests, and I expect future changes to be minor.

There are some noteworthy issues, I'd like to discuss before considering this not-WIP.

First, the OCSP test cert chain. I had to re-generate the whole cert chain and add the serverAuth flag to the OCSP certificates of the test suite. This is so because the same cert chain is used for the OCSP server and the HTTPS server in the test-ocsp-server test (the test spawns those two servers). OpenSSL will reject HTTPS certificates that don't have the serverAuth flag, whereas GnuTLS doesn't seem to care, at least by default. With this change, both test suites (OpenSSL and GnuTLS) pass to me.

There are some missing features, and I'll continue working on them and pushing new patches, hopefully, before new year.

  • OCSP stapling
  • Some stats
  • TFO not working on kernels <4.11 (issue #472 tracks this).

There are some untested features, I'd like to write tests for. These hold for both OpenSSL and GnuTLS backends: the WGET_SSL_OCSP_DATE (rejects OCSP response if it's older than 3 days) and WGET_SSL_OCSP_NONCE (sends a nonce in the OCSP request) are untested.

Approver's checklist:

  • The author has submitted the FSF Copyright Assignment and is listed in AUTHORS
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent with existing code
  • This feature/change has adequate documentation added (if appropriate)
  • No obvious mistakes / misspelling in the code

Merge request reports