indutny / indutny/ocsp

Cert and Nonce Missing from OCSP Response?

Open
#31 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
86
Forks
46
PR merge metrics
No merged PRs in 30d

Description

I've only been able to test this partially.
I see from openssl's ocsp test tool used something like this.

`openssl ocsp -issuer CA_pem.crt -cert server-pem.crt -text -url http://some.domain.server/`

That an error about missing the nonce appears.

```
WARNING: no nonce in response
Response Verify Failure
```
I think there is something else not working in my initial attempts maybe wrong cert or because of chaining etc. so it might evaporate but the initial WARNING is about missing the nonce

It is an Extended Response concept, seen in the test tools initial request output
```
Request Extensions:
OCSP Nonce:
04E900581CE39516????....?????945FF2CD43DD160

```

I searched this codebase for nonce and got nothing except in the request generator.
all I can find is this TODO that mentions Extensions might be missing from the response still!?

`TODO(indutny): send extensions`

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the request generator and the TODO `send extensions`, then compare the generated OCSP response with the OpenSSL command and its nonce warning. Confirm whether response extensions are missing and define done as an OpenSSL verification that no longer reports the missing nonce.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.