RE: OCSP-validation fails - UPDATE

I have now verified that if I use openssl directly from command line it wil=
l verify OK. Apparently there is no need for signing the request. =20

>openssl ocsp -issuer /usr/local/apache2/conf/SITHS_CA_v3.cer -CAfile /usr/=
local/apache2/conf/SITHS_CA_v3.cer -cert /mnt/download/uwcert.cer -text -ur=
l http://ocsp.trust.telia.com
.
.
.
.
Response verify OK
/mnt/download/uwcert.cer: good
	This Update: Jul 29 10:43:41 2010 GMT
	Next Update: Jul 30 10:43:45 2010 GMT

/ulfW



-----Original Message-----
From: [email protected] [mailto:[email protected]] =
On Behalf Of Ulf Wahlqvist
Sent: den 27 juli 2010 16:43
To: [email protected]
Subject: OCSP-validation fails

Hi


I'm trying to get Apache to do Client certificate verification with OCSP-va=
lidation.
It works without OCSP, but OCSP-validation fails when I turn it on.

The error is "OCSP_check_validity:status too old", but that doesn't make se=
nse because the clocks are within 2 seconds.=20
The client (Apache) says "Mon Jul 26 15:50:06.488292 2010" and the response=
 says "Mon, 26 Jul 2010 13:50:05 GMT" which is the same time.

//// Can there be a problem with comparing timestamps?

A more likely problem might be that the OCSP-responder require a SIGNED mes=
sage, but I don't understand how to get Apache to sign it. Some European OC=
SP-responders seems to accept only signed requests and I'm trying to find o=
ut if this is one of them.

//// Will Apache be able to sign OCSP-requests ( In that case - How do I pa=
ss the cert/key) ?=20

** my config **************************************************************=
***********************************************************************=20

[root@fedoragui logs]# httpd -v
Server version: Apache/2.3.6 (Unix)
Server built:=A0=A0 Jul 16 2010 15:31:39

[root@fedoragui logs]# openssl version
OpenSSL 1.0.0a-fips 1 Jun 2010

./configure --enable-ssl


** error_log **************************************************************=
***********************************************************************

[Mon Jul 26 15:50:05.782378 2010] [info] [pid 9164:tid 3053448048] [client =
10.0.2.2:2112] Connection to child 193 established (server fedoragui.mydoma=
in.com:443) [Mon Jul 26 15:50:06.461652 2010] [debug] [pid 9164:tid 3053448=
048] ssl_util_ocsp.c(79): [client 10.0.2.2:2112] connecting to OCSP respond=
er 'ocsp.trust.telia.com'
[Mon Jul 26 15:50:06.466167 2010] [debug] [pid 9164:tid 3053448048] ssl_uti=
l_ocsp.c(105): [client 10.0.2.2:2112] sending request to OCSP responder [Mo=
n Jul 26 15:50:06.488292 2010] [debug] [pid 9164:tid 3053448048] ssl_util_o=
csp.c(209): [client 10.0.2.2:2112] OCSP response header: Date: Mon, 26 Jul =
2010 13:50:05 GMT [Mon Jul 26 15:50:06.493946 2010] [debug] [pid 9164:tid 3=
053448048] ssl_util_ocsp.c(209): [client 10.0.2.2:2112] OCSP response heade=
r: Server: Apache [Mon Jul 26 15:50:06.494352 2010] [debug] [pid 9164:tid 3=
053448048] ssl_util_ocsp.c(209): [client 10.0.2.2:2112] OCSP response heade=
r: Content-Length: 1264 [Mon Jul 26 15:50:06.494828 2010] [debug] [pid 9164=
:tid 3053448048] ssl_util_ocsp.c(209): [client 10.0.2.2:2112] OCSP response=
 header: Connection: close [Mon Jul 26 15:50:06.495071 2010] [debug] [pid 9=
164:tid 3053448048] ssl_util_ocsp.c(209): [client 10.0.2.2:2112] OCSP respo=
nse header: Content-Type: application/ocsp-response [Mon Jul 26 15:50:06.49=
5303 2010] [debug] [pid 9164:tid 3053448048] ssl_util_ocsp.c(252): [client =
10.0.2.2:2112] OCSP response: got 1264 bytes, 1264 total [Mon Jul 26 15:50:=
06.498272 2010] [debug] [pid 9164:tid 3053448048] ssl_util_ocsp.c(235): [cl=
ient 10.0.2.2:2112] OCSP response: got EOF [Mon Jul 26 15:50:06.500184 2010=
] [error] [pid 9164:tid 3053448048] SSL Library Error: error:2707307F:OCSP =
routines:OCSP_check_validity:status too old [Mon Jul 26 15:50:06.504012 201=
0] [error] [pid 9164:tid 3053448048] [client 10.0.2.2:2112] Certificate Ver=
ification: Error (50): application verification failure [Mon Jul 26 15:50:0=
6.504430 2010] [info] [pid 9164:tid 3053448048] [client 10.0.2.2:2112] SSL =
library error 1 in handshake (server fedoragui.mydomain.com:443)

/ulfW

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]