Context Navigation

← Previous Ticket
Next Ticket →

#556 closed defect (wontfix)

OCSP stapling not working with comodo PositiveSSL

Reported by:	Frederik Schwan	Owned by:
Priority:	major	Milestone:
Component:	nginx-module	Version:	1.5.x
Keywords:	OCSP SSL	Cc:
uname -a:	Linux heimdall 3.14.2-1-ARCH #1 SMP PREEMPT Sun Apr 27 11:28:44 CEST 2014 x86_64 GNU/Linux
nginx -V:	nginx version: nginx/1.6.0 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --conf-path=/etc/nginx/nginx.conf --sbin-path=/usr/bin/nginx --pid-path=/run/nginx.pid --lock-path=/run/lock/nginx.lock --user=http --group=http --http-log-path=/var/log/nginx/access.log --error-log-path=stderr --http-client-body-temp-path=/var/lib/nginx/client-body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-imap --with-imap_ssl_module --with-ipv6 --with-pcre-jit --with-file-aio --with-http_dav_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_realip_module --with-http_spdy_module --with-http_ssl_module --with-http_stub_status_module --with-http_addition_module --with-http_degradation_module --with-http_flv_module --with-http_mp4_module --with-http_secure_link_module --with-http_sub_module

Description

When using OCSP stapling

resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
ssl_stapling on;
ssl_stapling_verify off;
ssl_trusted_certificate /etc/ssl/private/chain.comodo.pem;
ssl_dhparam /etc/nginx/dh_2048.pem;

I get the following log entry:

Mai 04 19:12:35 heimdall nginx[4573]: 2014/05/04 19:12:35 [error] 4576#0: OCSP_basic_verify() failed (SSL: error:27069076:OCSP routines:OCSP_basic_verify:signer certificate not found) while requesting certificate status, responder: ocsp.comodoca.com

So I decided to do some trial and error with openssl. The only way the certificate has been proved correct is to use the "-VAfile" option. Using CA, CAfile does not work. Seems to me that the way comodo signs its OCSP answer is not very usual. They don't ship the signing certificate with the answer and don't mark the cert as a OCSP signing certificate. Lastly they even don't use their CA Cert, but an intermediate certificate (the issuer) to sign.

Since the "-VAfile" option works I suggest to let nginx invoke openssl with this option.

RootCA and intermediates attached as well as a OCSP answer generated with openssl (OpenSSL 1.0.1g 7 Apr 2014).

Attachments (1)

resp.der (472 bytes ) - added by Frederik Schwan 11 years ago.: OCSP response

Download all attachments as: .zip

Change History (11)

by Frederik Schwan, 11 years ago

Attachment:	resp.der added

OCSP response

comment:1 by Frederik Schwan, 11 years ago

Upload button does not let me upload the cert file. So I put it here:

comment:2 by Frederik Schwan, 11 years ago

Patch provided here solves problem for openssl:
http://rt.openssl.org/Ticket/Display.html?id=2206

Patch: http://rt.openssl.org/Ticket/Attachment/26247/12756/implicit_non_delegated_ocsp_100beta5.patch

Since nginx has it's own logic to provide the arguments for OCSP_basic_verify in line 593 of ngx_event_openssl_stapling.c the patch need to be ported from openssl to nginx.

comment:3 by Frederik Schwan, 11 years ago

Ivestigated futher and made this patch:

--- aaa/src/event/ngx_event_openssl_stapling.c	2014-05-04 23:09:30.000000000 +0200
+++ bbb/src/event/ngx_event_openssl_stapling.c	2014-05-04 23:09:11.000000000 +0200
@@ -533,7 +533,7 @@
     size_t                 len;
     ngx_str_t              response;
     X509_STORE            *store;
-    STACK_OF(X509)        *chain;
+    STACK_OF(X509)        *chain, *issuer_st;
     OCSP_CERTID           *id;
     OCSP_RESPONSE         *ocsp;
     OCSP_BASICRESP        *basic;
@@ -553,6 +553,8 @@
 
     len = ctx->response->last - ctx->response->pos;
     p = ctx->response->pos;
+    issuer_st = sk_X509_new_null();
+    sk_X509_push(issuer_st, staple->issuer);
 
     ocsp = d2i_OCSP_RESPONSE(NULL, &p, len);
     if (ocsp == NULL) {
@@ -589,14 +591,17 @@
 #else
     chain = staple->ssl_ctx->extra_certs;
 #endif
-
+    
     if (OCSP_basic_verify(basic, chain, store,
-                          staple->verify ? OCSP_TRUSTOTHER : OCSP_NOVERIFY)
-        != 1)
-    {
-        ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
+                          staple->verify ? OCSP_TRUSTOTHER : OCSP_NOVERIFY) <= 0){
+        if(issuer_st && OCSP_basic_verify(basic, issuer_st, store, OCSP_TRUSTOTHER) > 0){
+            ERR_clear_error();
+        }
+        else {
+            ngx_ssl_error(NGX_LOG_ERR, ctx->log, 0,
                       "OCSP_basic_verify() failed");
-        goto error;
+            goto error;
+        }
     }
 
     id = OCSP_cert_to_id(NULL, ctx->cert, ctx->issuer);

Checks issuer separately if check of chain fails.
Thanks to Rob Stradling for providing the corresponding patch for OpenSSL.

Version 0, edited 11 years ago by Frederik Schwan (next)

comment:4 by Maxim Dounin, 10 years ago

Resolution:	→ wontfix
Status:	new → closed

It is believed that the underlying problem is in the OpenSSL library code, not in nginx. It should not fail OCSP response verification as long as the issuer certificate is in the store provided. Nevertheless, trivial workaround is to put issuer certificate into the certificate file as described in Configuring HTTPS servers instead of putting it into a trusted certificate store.

comment:5 by Frederik Schwan, 10 years ago

Putting issuer cert in certificate file is not a workaround - does not work.
Agree, that problem is the underlying OpenSSL lib. Will look into that.
Thanks

comment:6 by Maxim Dounin, 10 years ago

The workaround works fine here, I've tested it before I suggested this as a workaround. You may also find from the code that certificate chain is passed to the OCSP_basic_verify() as the "certs" argument, so it's basically identical to what you are doing with your patch. You may want to try again if it doesn't work for you.

comment:7 by Frederik Schwan, 10 years ago

Just tried it. Using cert-chain with issuer leads to "signer certificate not found"-error. If I try to manually check the OCSP response I have to use -VAfile issuer.crt. But without that option, only specifiying the whole trust chain (in which the issuer actually is) the ocsp response seems to be not valid.

I don't think that the OpenSSL patch I mentioned is the right way to fix this - it's only a workaround. There is something wrong in the OpenSSL routine that searches for the issuer in the chain.

BTW: Tried a RapidSSL cert. It's working fine with ocsp (it is not using the delegated model).

comment:8 by Maxim Dounin, 10 years ago

The workaround is not for OpenSSL command line interface, it's for nginx. Put a chain into the file you use in the ssl_certificate directive, as documented at http://nginx.org/en/docs/http/configuring_https_servers.html#chains. If it doesn't work for you, you may want to provide more details.

comment:9 by Frederik Schwan, 10 years ago

As I already wrote twice: I've tried to add the issuer cert to the nginx chain in many ways and also as described in the manpage (http://nginx.org/en/docs/http/configuring_https_servers.html#chains).

You find the chain, a working OpenSSL patch (workaround) and a working nginx patch (workaround) above.

You can break it down into two OpenSSL functions that are causing the problem:
ocsp_vfy.c - static int ocsp_find_signer
ocsp_vfy.c - static X509 *ocsp_find_signer_sk

The first one is called in ocsp_vfy.c at line 82. We get the error of this bug in line 85, since no issuer is found.
The strange thing: We find an issuer when STACK_OF(x509) *certs contains ONLY the issuer and nothing else....

comment:10 by Maxim Dounin, 10 years ago

The "strange thing" suggests that OpenSSL thinks there is no issuer certificate in the chain you are trying to use. This may be, e.g., if the pem file with the chain is corrupted, and e.g. there is a missing or extra char in the "-----BEGIN CERTIFICATE-----" line of the issuer certificate.

Note: See TracTickets for help on using tickets.

Download in other formats: