OCSP - Trusted responder model
murugesh pitchaiah <[email protected]> Wed, 3 Aug 2022 22:22:45 +0530
| Newsgroups | gmane.comp.encryption.openssl.user,gmane.comp.encryption.openssl.devel |
|---|---|
| Message-ID | <CAOu9RAfkbzoX+jx3rYbMA-xq8GRTG6MrG1FKq1Mk75ocVPxUQw@mail.gmail.com> |
--0000000000008e18ea05e55910cf Content-Type: text/plain; charset="UTF-8" Hi, I am looking for testing the Trusted OCSP responder model. Here is the certificate hierarchy: 1) rootca-->subca-->leaf 2) responderca (another root ca) subChain : Contains both subca and rootca index.txt - contains the entries for subca and leaf OCSP Request is raised in the sequence: 1) leaf 2) subca This is how the i tried running the ocsp responder: > openssl ocsp -port 2561 -text -index index.txt -CA subChain -rkey respondercakey.pem -rsigner respondercacert.pem Here got good response for leaf but for subca - unknown is returned by responder > openssl ocsp -port 2561 -text -index index.txt -CA cacert.pem -rkey respondercakey.pem -rsigner respondercacert.pem Here unknown is returned by responder for leaf Could you please help here with what I am missing ? Is there any other way to give the "CA" option while running "global responder" -that is a trusted responder model ? Thanks, Murugesh --0000000000008e18ea05e55910cf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi,<div><br></div><div>I am looking for testing the Truste= d OCSP responder model.</div><div>Here is the certificate hierarchy:</div><= div>1) rootca-->subca-->leaf</div><div>2) responderca (another root c= a)</div><div><br></div><div>subChain : Contains both subca and rootca</div>= <div>index.txt - contains the entries for subca and leaf</div><div><br></di= v><div>OCSP Request is raised in the sequence: 1) leaf 2) subca</div><div><= br></div><div>This is how the i tried running the ocsp responder:</div><div= ><br></div><div>> openssl ocsp -port 2561 -text -index index.txt -CA sub= Chain =C2=A0-rkey respondercakey.pem=C2=A0 -rsigner=C2=A0respondercacert.pe= m<br></div><div>Here got good response for leaf but for subca - unknown is = returned by responder</div><div><br></div><div>> openssl ocsp -port 2561= -text -index index.txt -CA cacert.pem =C2=A0-rkey=C2=A0 respondercakey.pem=C2=A0 -rsigner=C2=A0respondercacert.pem <br></div><div>Here unknown is returned by responder for leaf</div><div><br= ></div><div>Could you please help here with what I am missing ? Is there an= y other way to give the "CA" option while running "global re= sponder" -that is a trusted responder model ?</div><div><br></div><div= >Thanks,</div><div>Murugesh</div></div> --0000000000008e18ea05e55910cf--