Re: OCSP-validation fails - Wrong cert passed to OCSP by Apache

Joe Orton <[email protected]> Tue, 17 Aug 2010 15:00:38 +0100

Newsgroups	gmane.comp.apache.mod-ssl.user
Organization	Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in UK and Wales under Company Registration No. 03798903 Directors: Michael Cunningham (USA), Brendan Lane (Ireland), Matt Parson (USA), Charlie Peters (USA)
Message-ID	<[email protected]>

On Tue, Aug 17, 2010 at 12:47:26PM +0200, Ulf Wahlqvist wrote:
> I still don't get it. I used Wireshark and found out that the 
> certificate sent to the OCSP-responder is the CA-cert, not the 
> client-cert to be validated! I am clueless.

The code tries to verify each cert in the client cert chain from issuing 
CA down to the end-entity client cert with the OCSP responder - this is 
expected behaviour.

The modssl-users@ was used for discussion of mod_ssl for Apache httpd 
1.3.  For discussion of OCSP in httpd 2.3 I'd recommend 
[email protected] - file bugs if you think the code is buggy.

http://issues.apache.org/bugzilla/

Regards, Joe
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]