Comments (4)
Well those ToDos explain what needs to be done, as well as show maybe they are actually optional. So far my variation is not happy so I'll try to complete those parts as well us understand why it doesn't like it.
Also note that I found the getResponses code to be excessive in the form with the dependency of async which in turn includes lodash. Instead of async map I went the route of map async so I would recommend rethinking that entire part of the server.
let pList = reqList.map( async ( req ) => {
return ocsp.getResponse( req );
});
Promise.all( pList ).then( ( resps ) => { };
Yup burned passing the callback around too, as it should respond 'unknown' instead of calling back with an error.
Thanks for the hints and asn1.js-rfc25?0 stuff, that totally blows my mind.
from ocsp.
Well it seems that really those TODOs are much more important and missing. NO Nonce and NO Certs is pretty important part of the response specification.
Ultimately it would be nice to have the TODOs done on server responses. aka Nonce and Cert added to responses.
[As a side note I had struggled for days with the ANS1 encoder barfing over key case aka certID vs certId and the formulation of certStatus. Next just passing Nonce as it comes triggers a crash asn1_check_tlen:wrong tag?]
[2 Days later: I am starting to think as close as this is I might have to totally rebuild with PKI.js]
from ocsp.
Right so It's really missing the cert that causes an unsightly error in openssl ocsp test.
so it appears the cert is not considered optional to omit.
Response Verify Failure
139808917545408:error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found:../crypto/ocsp/ocsp_vfy.c:41:
139808917545408:error:0D0C50C8:asn1 encoding routines:ASN1_item_verify:wrong public key type:../crypto/asn1/a_verify.c:140:
139808917545408:error:27069075:OCSP routines:OCSP_basic_verify:signature failure:../crypto/ocsp/ocsp_vfy.c:60:
My initial attempts to reintegrate or rebuild with PKI have lead me to conclude that library is way too massive for this otherwise almost working simple OCSP response.
The Nonce of course makes even more sense to have even though it's in theory optional.
I've burned too much time to carry on this repair job for the moment, for something Chrome doesn't even bother with anymore.
It would be really great if someone could complete this (Nonce and Cert in OCSP Response) or give some idea of if the pieces are already here somewhere waiting to be integrated or there are entire sections completely missing that would really take more then a few days or weeks even to add here, thanks.
from ocsp.
This can be solved by fixing the rfc2560 response extensions index from 0 to 1.
Just submitted a pull request
from ocsp.
Related Issues (20)
- How to enable ocsp? HOT 1
- Cannot read property _getEncoder of undefined when parsing staging letsencrypt certs HOT 8
- Verification failure on many popular sites HOT 3
- Question: Is there an event to tell whether an OCSP request was fulfilled via cache vs sent to the CA?
- Test failing in .check() HOT 4
- Is posible to use a database instead ocsp server add method ? HOT 1
- OCSP check failed against windows blob storage
- TimeoutOverflowWarning with large nextUpdate values
- [Question] Set response property 'revoked' = true instead of throwing error?
- No support for more advanced signing algorithms
- error from ocsp agent HOT 1
- Check() through a proxy?
- Bad decrypt. HOT 2
- OCSP cache doesnโt have a means of clearing all cache invalidation check intervals
- Tests failing
- Invalid signature leads to process termination HOT 1
- Bump version of asn1.js to avoid deprecated `new Buffer()` calls HOT 1
- ocsp.check() ends with 'Error: Invalid signature'
- How to enable ocsp in web socket
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ocsp.