OCSP-validation fails

Hi


I'm trying to get Apache to do Client certificate verification with OCSP-va=
lidation.
It works without OCSP, but OCSP-validation fails when I turn it on.

The error is "OCSP_check_validity:status too old", but that doesn't make se=
nse because the clocks are within 2 seconds.=20
The client (Apache) says "Mon Jul 26 15:50:06.488292 2010" and the response=
 says "Mon, 26 Jul 2010 13:50:05 GMT" which is the same time.

//// Can there be a problem with comparing timestamps?

A more likely problem might be that the OCSP-responder require a SIGNED mes=
sage, but I don't understand how to get Apache to sign it. Some European OC=
SP-responders seems to accept only signed requests and I'm trying to find o=
ut if this is one of them.

//// Will Apache be able to sign OCSP-requests ( In that case - How do I pa=
ss the cert/key) ?=20

** my config **************************************************************=
***********************************************************************=20

[root@fedoragui logs]# httpd -v
Server version: Apache/2.3.6 (Unix)
Server built:=A0=A0 Jul 16 2010 15:31:39

[root@fedoragui logs]# openssl version
OpenSSL 1.0.0a-fips 1 Jun 2010

./configure --enable-ssl


** error_log **************************************************************=
***********************************************************************

[Mon Jul 26 15:50:05.782378 2010] [info] [pid 9164:tid 3053448048] [client =
10.0.2.2:2112] Connection to child 193 established (server fedoragui.mydoma=
in.com:443)
[Mon Jul 26 15:50:06.461652 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(79): [client 10.0.2.2:2112] connecting to OCSP responder 'ocsp.tru=
st.telia.com'
[Mon Jul 26 15:50:06.466167 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(105): [client 10.0.2.2:2112] sending request to OCSP responder
[Mon Jul 26 15:50:06.488292 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(209): [client 10.0.2.2:2112] OCSP response header: Date: Mon, 26 J=
ul 2010 13:50:05 GMT
[Mon Jul 26 15:50:06.493946 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(209): [client 10.0.2.2:2112] OCSP response header: Server: Apache
[Mon Jul 26 15:50:06.494352 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(209): [client 10.0.2.2:2112] OCSP response header: Content-Length:=
 1264
[Mon Jul 26 15:50:06.494828 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(209): [client 10.0.2.2:2112] OCSP response header: Connection: clo=
se
[Mon Jul 26 15:50:06.495071 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(209): [client 10.0.2.2:2112] OCSP response header: Content-Type: a=
pplication/ocsp-response
[Mon Jul 26 15:50:06.495303 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(252): [client 10.0.2.2:2112] OCSP response: got 1264 bytes, 1264 t=
otal
[Mon Jul 26 15:50:06.498272 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(235): [client 10.0.2.2:2112] OCSP response: got EOF
[Mon Jul 26 15:50:06.500184 2010] [error] [pid 9164:tid 3053448048] SSL Lib=
rary Error: error:2707307F:OCSP routines:OCSP_check_validity:status too old
[Mon Jul 26 15:50:06.504012 2010] [error] [pid 9164:tid 3053448048] [client=
 10.0.2.2:2112] Certificate Verification: Error (50): application verificat=
ion failure
[Mon Jul 26 15:50:06.504430 2010] [info] [pid 9164:tid 3053448048] [client =
10.0.2.2:2112] SSL library error 1 in handshake (server fedoragui.mydomain.=
com:443)

/ulfW

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]