Skip to content

OCSP requests received with cert=issuer=null when server started with PFX #4127

Closed
Closed
OCSP requests received with cert=issuer=null when server started with PFX#4127
Labels
tlsIssues and PRs related to the tls subsystem.

Description

@djphoenix
djphoenix
opened on Dec 3, 2015

Test script: https://git.phoenix.dj/snippets/6
Place it into folder that contains:

  1. cer.cer: certificate that contains OCSP responder address
  2. cer.key: keyfile for certificate
  3. ca.cer: certificate issuer
  4. cer.pfx: PFX with certificate, ca and key (openssl pkcs12 -export -in cer.cer -inkey cer.key -certfile ca.cer -out cer.pfx -password pass:)

Then run node ocsptest.js
On work PC (Mac OS X EI Capitan, homebrew version):

$ node ocsptest.js 
Node version: v4.1.1 

--- Testing CER+KEY ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: false, issuer: false }
closing...

--- Testing PFX ---
OCSP request { cert: false, issuer: false }
OCSP request { cert: false, issuer: false }
closing...

--- Testing PFX+SNICRT ---
OCSP request { cert: false, issuer: false }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNIPFX ---
OCSP request { cert: false, issuer: false }
SNI 127.0.0.1
OCSP request { cert: false, issuer: false }
closing...

Done

On my server (Debian GNU/Linux 8, deb.nodesource.com/node_4.x):

$ node ocsptest.js 
Node version: v4.2.2 
... exactly same

VMware (Debian GNU/Linux 8, deb.nodesource.com/node_5.x):

$ node ocsptest.js 
Node version: v5.1.0 
... exactly same

Activity

  1. mscdex
    added
    tlsIssues and PRs related to the tls subsystem.
    on Dec 3, 2015

  2. mscdex commented on Dec 3, 2015

    @mscdex
    mscdex
    on Dec 3, 2015
    Contributor

    /cc @nodejs/crypto

  3. indutny commented on Dec 5, 2015

    @indutny
    indutny
    on Dec 5, 2015
    Member

    Confirmed, working on a fix.

  4. indutny
    added a commit that references this issue on Dec 5, 2015

    crypto: load PFX chain the same way as regular one

    d04c1f6

  5. indutny commented on Dec 5, 2015

    @indutny
    indutny
    on Dec 5, 2015
    Member

    @djphoenix may I ask you to give a try to this patch, please ? #4165

  6. indutny
    added a commit that references this issue on Dec 6, 2015

    test: add regression test for nodejs#4127

    4e9d541

  7. djphoenix commented on Dec 6, 2015

    @djphoenix
    djphoenix
    on Dec 6, 2015
    ContributorAuthor
    # ~/nodejs/node-v5.1.1/node ocsptest.js 
Node version: v5.1.1 
... same as reference

# ~/nodejs/node-v5.1.1-patched/node ocsptest.js 
Node version: v5.1.1 

--- Testing CER+KEY ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

Done

    Perfect work, @indutny!

  8. djphoenix commented on Dec 7, 2015

    @djphoenix
    djphoenix
    on Dec 7, 2015
    ContributorAuthor

    Will fix release for 5.x only, or 4.x too?

  9. indutny commented on Dec 7, 2015

    @indutny
    indutny
    on Dec 7, 2015
    Member

    @djphoenix 4.x too

  10. indutny
    closed this as completedin a2c1799on Dec 18, 2015
  11. Fishrock123
    added a commit that references this issue on Dec 22, 2015

    crypto: load PFX chain the same way as regular one

    6406dbb
  12. MylesBorins
    added 2 commits that reference this issue on Jan 13, 2016

    crypto: load PFX chain the same way as regular one

    bb0a964

    crypto: load PFX chain the same way as regular one

    d19da66
  13. scovetta
    added a commit that references this issue on Apr 2, 2016

    crypto: load PFX chain the same way as regular one

    dacb2fc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    tlsIssues and PRs related to the tls subsystem.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions