Skip to content

OpenSSL: OCSP support

Ander Juaristi requested to merge wget2-openssl into master

Here comes, finally the OCSP implementation with the OpenSSL backend.

This MR implements the following features:

  • OCSP
  • TLS stats from the OpenSSL backend

I had to re-generate the whole cert chain and add the serverAuth flag to the OCSP certificates of the test suite. This is so because the same cert chain is used for the OCSP server and the HTTPS server in the test-ocsp-server test (the test spawns those two servers). OpenSSL will reject HTTPS certificates that don't have the serverAuth flag, whereas GnuTLS doesn't seem to care, at least by default. With this change, both test suites (OpenSSL and GnuTLS) pass to me.

The major missing part is OCSP stapling and as such, this MR skips the OCSP stapling tests for the OpenSSL backend. My intention is to close #475 (closed) with this MR, and open a new one to track that. I am currently working on OCSP stapling in OpenSSL but there are some issues that prevent me from getting it to work. I hope I'll solve them soon. In the meanwhile, I thought it'd be better to close the previous MR (!460 (closed)) and open a new one, because I was falling too much behind the master branch, and these features are ready to be merged from my point of view.

There are also some untested features (for both backends - OpenSSL and GnuTLS). I'll open new issues for those as well.

Missing features:

  • OCSP stapling (status_request extension, RFC 6066).

Approver's checklist:

  • The author has submitted the FSF Copyright Assignment and is listed in AUTHORS
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent with existing code
  • This feature/change has adequate documentation added (if appropriate)
  • No obvious mistakes / misspelling in the code

Merge request reports