From: <oh...@ya...> - 2019-08-05 21:33:18
|
Hi, I have testing against one of our CRLs, and in there, we have a cert serial 2FB227. Here's the output from the "openssl crl" for that serial number: Serial Number: 2FB227 Revocation Date: Jul 23 13:43:55 2019 GMT CRL entry extensions: X509v3 CRL Reason Code: Superseded Invalidity Date: Jul 23 13:43:39 2019 GMT However, when I run an "openssl ocspd" (send a request) test, against OpenCA OCSPD with this CRL, I am getting this: OCSP Request Data: Version: 1 (0x0) Requestor List: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: 9FC23C79C5BC28FDCD3EC6E5201AECCD200DABE4 Issuer Key Hash: 5B91C64436F228F2F8CFB2C2C8CA6349619B200A Serial Number: 2FB227 Request Extensions: OCSP Nonce: 04109ED8FB9BFBBC1900A6B08972EBC308F7 Response verify OK 0x2FB227: good This Update: Aug 5 21:27:45 2019 GMT Next Update: Aug 5 21:32:45 2019 GMT So, it looks like, from the CRL, the cert was Revoked, because it was "superceded", and then when I run an OCSP request for the serial number, OpenCA OCSPD is sending an OCSP response that does not indicate that the cert was revoked? I am not that familiar with the RFC's (and with the "Superceded" reason) but is that a "correct" OCSP response for that revoked entry in the CRL file? Shouldn't OpenCA OCSPD be sending an OCSP response that indicates that the certificate with that serial number has been Revoked? Thanks,Jim |