OCSP client certificate validation

[gfrankliu@…]

As discussed here ​https://forum.nginx.org/read.php?2,252893,252895
It would be great if nginx can support using OCSP for validating client certificates.

[laurivosandi@…]

I am also interested in this feature

[maxim]

Milestone renamed

[boardbloke@…]

+1 We have a number of use cases that require Mutual TLS with OCSP responder checking.

We would really like to be able to use NGINX for this, but presently have no option but to use competitor products

[maxim]

Ticket retargeted after milestone closed

[sempercr@…]

Again as stated by my colleague in a previous post, we have several use cases that require Mutual TLS with OCSP responder checking. Since we have already implemented Nginx within our Ecosystem, we would like to move forward with a solution from the NGINX team. Please look into providing this as this would benefit the community as a hole.

[kurbar@…]

Estonia uses OCSP to verify client certificate validity for national ID cards. This feature would be awesome as it would make identifications more effective.

[Roman Arutyunyan]

In 7653:8409f9df6219/nginx:

SSL: client certificate validation with OCSP (ticket #1534).

OCSP validation for client certificates is enabled by the "ssl_ocsp" directive.
OCSP responder can be optionally specified by "ssl_ocsp_responder".

When session is reused, peer chain is not available for validation.
If the verified chain contains certificates from the peer chain not available
at the server, validation will fail.

[Roman Arutyunyan]

Fix committed.