indutny / indutny/ocsp

OCSP check failed against windows blob storage

Open
#27 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
86
Forks
46
PR merge metrics
No merged PRs in 30d

Description

I am using ocsp 1.2.0 and latest of asn1.js-rfc5280. However, ocsp check failed with error `Invalid signauture` when checking against azure blob storage(while it succeed for amazons s3). So I am wondering what is wrong, and also, is there anyway to turn on logging to further troubleshooting the issue.

I wrote a simple javascript to reproduce the issue. Note, check failed on windows.net, but succeed for s3 endpoint.
```
const tls = require('tls');
const ocsp = require('ocsp');
const rfc5280 = require('asn1.js-rfc5280');

const options = {
host: "2srsfctest1stage000.blob.core.windows.net",
//host: "s3-eu-west-1.amazonaws.com",
port: 443
};

const socket = tls.connect(8000, options, function(){
cert = socket.getPeerCertificate(true);
var issuer = cert.issuerCertificate;
cert = cert.raw;
try {
cert = rfc5280.Certificate.decode(cert, 'der');

if (issuer) {
issuer = issuer.raw;
issuer = rfc5280.Certificate.decode(issuer, 'der');
}
} catch (e) {
console.log(e);
}

ocsp.check({
cert: cert,
issuer: issuer
}, function(err, res){
if (err)
{
console.log(err);
}

if (res)
{
console.log(res);
}
})
});
```

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the provided JavaScript reproduction with the Azure Blob Storage host and the S3 host for comparison, focusing on the tls connection and ocsp.check call. Investigate the reported “Invalid signauture” result and whether the ocsp package exposes logging; done means explaining the endpoint difference or identifying the needed diagnostic or fix.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, javascript, node.js
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.