Responses from OpenCA's OCSPd supported?
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 86
- Forks
- 46
- PR merge metrics
- No merged PRs in 30d
Description
Hello.. thanks for this module, it's definitely needed.
When testing check() with a good cert against OCSPd (from the OpenCA project), it's throwing "Invalid signature."
OCSPd logs:
```
Aug 6 13:53:49 watchtower ocspd[9710]: Request for certificate serial 4096
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:684] [DEBUG] CRL::CA [ca-ec-sockets] nameHash OK
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:699] [DEBUG] CRL::CA [ca-ec-sockets] issuerKeyHash OK
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:324] [DEBUG] Using the specific token for the found CA (ca-ec-sockets)
Aug 6 13:53:49 watchtower ocspd[9710]: valid certificate status [serial 4096]
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:84] [DEBUG] Digest Algorithm For Signature: SHA1
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:97] [DEBUG] Signing Certificate:
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:98] [DEBUG] - Serial .....: 4100
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:99] [DEBUG] - Subject ....: C=US, ST=Nevada, L=Las Vegas, O=MyCompany Inc., CN=ocsp-sockets.mycompany.com
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:100] [DEBUG] - Issuer .....: C=US, ST=Nevada, L=Las Vegas, O=MyCompany Inc., CN=MyCompany Sockets Root CA
Aug 6 13:53:49 watchtower ocspd[9710]: [hsm_main.c:648] [DEBUG] Signature Size (512 bytes)
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:119] [DEBUG] Response signed successfully
Aug 6 13:53:49 watchtower ocspd[9710]: [response.c:622] [DEBUG] OCSP Response Bytes = 2333, HTTP Header Bytes = 184
```
When trying to trace through your verification code I noticed:
```
// TODO(indutny): support other responders
```
So I was just curious if there might be a known issue with OSCPd before digging further.
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing check() through the verification code, especially the area marked "TODO(indutny): support other responders," and compare its behavior with the OCSPd response details in the issue. Determine whether OCSPd responses can be verified by this module; done means adding confirmed support or documenting the incompatibility with appropriate verification coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100