<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-CH" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Good idea, i have tried it now but doesn't change anything<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-CH" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> nginx <nginx-bounces@nginx.org>
<b>On Behalf Of </b>Vahan Yerkanian<br>
<b>Sent:</b> Tuesday, January 4, 2022 2:20 PM<br>
<b>To:</b> nginx@nginx.org<br>
<b>Subject:</b> Re: OCSP, client certificate verification with chained CA<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:black">Have you tried increasing the depth?</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
<br>
</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="color:black"> ssl_verify_depth 3;</span> <o:p>
</o:p></p>
<div>
<p class="MsoNormal"><span style="color:black"><br>
<br>
</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
<br>
</span><o:p></o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 4 Jan 2022, at 15:10, Marti, Ueli (Marin) <<a href="mailto:Ueli.Marti@ch.glory-global.com">Ueli.Marti@ch.glory-global.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi,<br>
i am trying to setup nginx for OCSP client certificate verification and have troubles getting it to work with chained CA's.<br>
My setup is as follows, all referenced files are in the attached archive.<br>
- RootCa (pki/root/RootCa*.*): Self signed root CA certificate<br>
- IntermediateCa (pki/intermediate/IntermediateCa*.*): Intermediate CA certificate signed by RootCa<br>
- ServerCertificate (pki/intermediate/ ServerCertificate *.*): Server certificate, signed by Intermediate CA<br>
- IntermediateClientA (pki/intermediate/IntermediateClientA*.*): Intermediate client certificate A, signed by Intermediate CA (password for p12: umtest)<br>
- IntermediateClientB (pki/intermediate/IntermediateClientB*.*): Intermediate client certificate B, signed by Intermediate CA, REVOKED (password for p12: umtest)<br>
- IntermediateOcspResponder (pki/intermediate/ IntermediateOcspResponder *.*): Intermediate OCSP responder certificate, extendedKeyUsage=OCSPSigning, signed by Intermediate CA<br>
<br>
- nginx 1.20.2 runs on a Manjaro virtual machine<br>
- openssl ocsp responder runs on the same Manjaro box, port 8080 (started with pki/startOcspResponder.sh):<br>
openssl ocsp -index intermediate/index.txt -port 8080 -rsigner intermediate/IntermediateOcspResponderCert.pem -rkey intermediate/IntermediateOcspResponderKey.pem -CA intermediate/IntermediateChainCaCert.pem -text &<br>
<br>
nginx mTls configuration is as follows (full nginx.conf attached):<br>
ssl_ocsp on;<br>
ssl_verify_client on;<br>
ssl_client_certificate /etc/nginx/pki/intermediate/IntermediateChainCaCert.pem;<br>
ssl_ocsp_responder <a href="https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2F127.0.0.1%3A8080%2F&data=04%7C01%7Cueli.marti%40ch.glory-global.com%7Ced5d871335f542aec27d08d9cf85028e%7C28825646ef414c9bb69e305d76fc24e5%7C0%7C0%7C637768994197063164%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0&sdata=ztqUJe1CESaa6gDHvq0bxxsjIxOL4eVsRpnIsV54QD8%3D&reserved=0">
http://127.0.0.1:8080</a>;<br>
ssl_verify_depth 2;<br>
<br>
I am trying to connect from Chrome, running on the Windows host, using alternatively Client A/B certificates.<br>
<br>
With the above configuration, connection with Client A fails, which is NOT expected, Client A should be able to connect.<br>
nginx error.log indicates:<br>
2022/01/04 10:06:29 [error] 2920#2920: *4 OCSP_basic_verify() failed (SSL: error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted) while requesting certificate status, responder: 127.0.0.1, peer: 127.0.0.1:8080<br>
<br>
Connection with Client B fails too, this is expected as Client B certificate is revoked,<br>
nginx error.log indicates:<br>
2022/01/04 10:06:42 [info] 2920#2920: *14 client SSL certificate verify error: certificate revoked while reading client request headers, client: 192.168.1.115, server: localhost, request: "GET / HTTP/1.1", host: "192.168.1.110"<br>
<br>
when changing nginx configuration to:<br>
ssl_ocsp leaf;<br>
everything works as expected, Client A can connect, Client B not.<br>
<br>
Trying ocsp verification dircetly using openssl cli, works as expected as well:<br>
openssl ocsp -issuer intermediate/IntermediateCaCert.pem -CAfile intermediate/IntermediateChainCaCert.pem -cert intermediate/IntermediateClientACert.pem -url
<a href="https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2F127.0.0.1%3A8080%2F&data=04%7C01%7Cueli.marti%40ch.glory-global.com%7Ced5d871335f542aec27d08d9cf85028e%7C28825646ef414c9bb69e305d76fc24e5%7C0%7C0%7C637768994197063164%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0&sdata=ztqUJe1CESaa6gDHvq0bxxsjIxOL4eVsRpnIsV54QD8%3D&reserved=0">
http://127.0.0.1:8080</a><br>
Response verify OK<br>
intermediate/IntermediateClientACert.pem: good<br>
This Update: Jan 4 09:20:56 2022 GMT<br>
<br>
openssl ocsp -issuer intermediate/IntermediateCaCert.pem -CAfile intermediate/IntermediateChainCaCert.pem -cert intermediate/IntermediateClientBCert.pem -url
<a href="https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2F127.0.0.1%3A8080%2F&data=04%7C01%7Cueli.marti%40ch.glory-global.com%7Ced5d871335f542aec27d08d9cf85028e%7C28825646ef414c9bb69e305d76fc24e5%7C0%7C0%7C637768994197063164%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0&sdata=ztqUJe1CESaa6gDHvq0bxxsjIxOL4eVsRpnIsV54QD8%3D&reserved=0">
http://127.0.0.1:8080</a><br>
Response verify OK<br>
intermediate/IntermediateClientBCert.pem: revoked<br>
This Update: Jan 4 09:21:37 2022 GMT<br>
Revocation Time: Dec 23 09:33:07 2021 GMT<br>
<br>
How do i need to configure nginx to make OCSP validation working for the certificate chain, not only the leaf ?<br>
Thanks<br>
This e-mail and any files attached are strictly confidential, may be legally privileged and are intended solely for the addressee. If you are not the intended recipient please notify the sender immediately by return email and then delete the e-mail and any
attachments immediately. The views and or opinions expressed in this e-mail are not necessarily the views of Glory Ltd, Glory Global Solutions Limited or any of their subsidiaries or affiliates and the GLORY Group of companies, their directors, officers and
employees make no representation about and accept no liability for its accuracy or completeness. You should ensure that you have adequate virus protection as the GLORY Group of companies do not accept liability for any viruses. Glory Global Solutions Limited
Registered No. 07945417 and Glory Global Solutions (International) Limited Registered No 6569621 are both registered in England and Wales with their registered office at: Infinity View, 1 Hazelwood, Lime Tree Way, Chineham, Basingstoke, Hampshire RG24 8WZ,
United Kingdom<br>
<nginx_pki.tar.gz>_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
http://mailman.nginx.org/mailman/listinfo/nginx<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>