John WoodandGitHub 4c8f1c5862 Fix OCSP checking (#274) ...

Fixes #272. The root of the problem is that we're asking the wrong OCSP servers. The current code does something like:

leaf, issuers := chain[0], chain[1:]
for _, issuer := range issuers {
  // check for revocation of leaf via issuer.OCSPServer
}

The main problem is that OCSPServer is the URI of the OCSP server for that certificate, and by asking issuer.OCSPServer about leaf, we're requesting OCSP responses from the wrong server. We should be checking leaf.OCSPServer in this example instead of issuer.OCSPServer.

The second problem is that the loop makes no sense. One would not expect any OCSP server in a given chain to be authoritative for a given leaf.

If you do certigo connect google.com, you'll see

Certificate has OCSP extension, but was unable to check status:
	ocsp: error from server: unauthorized

The "unauthorized" means the OCSP server we asked doesn't know anything about the cert we asked about.

2022-06-28 14:51:03 -07:00

..

certs.go

print input format guessed by certigo (#210)

2020-02-25 11:17:01 -08:00

display.go

Print only CN for verify results

2018-02-27 17:24:48 -08:00

encoder.go

Add the Ed25519 algo to the list of known algo names (#250)

2021-11-30 15:19:09 -08:00

ocsp.go

Fix OCSP checking (#274)

2022-06-28 14:51:03 -07:00

oids.go

Add DomainComponent from RFC 2247

2019-03-27 22:51:22 -07:00

tls.go

Add additional TLS 1.3 cipher suites (#208)

2020-02-26 10:29:40 -08:00

verify.go

Fix OCSP checking (#274)

2022-06-28 14:51:03 -07:00