Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCSP requests received with cert=issuer=null when server started with PFX #4127

Closed
djphoenix opened this issue Dec 3, 2015 · 6 comments
Closed

OCSP requests received with cert=issuer=null when server started with PFX #4127

djphoenix opened this issue Dec 3, 2015 · 6 comments
Labels
tls Issues and PRs related to the tls subsystem.

Comments

@djphoenix
Copy link
Contributor

Test script: https://git.phoenix.dj/snippets/6
Place it into folder that contains:

  1. cer.cer: certificate that contains OCSP responder address
  2. cer.key: keyfile for certificate
  3. ca.cer: certificate issuer
  4. cer.pfx: PFX with certificate, ca and key (openssl pkcs12 -export -in cer.cer -inkey cer.key -certfile ca.cer -out cer.pfx -password pass:)

Then run node ocsptest.js
On work PC (Mac OS X EI Capitan, homebrew version):

$ node ocsptest.js 
Node version: v4.1.1 

--- Testing CER+KEY ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: false, issuer: false }
closing...

--- Testing PFX ---
OCSP request { cert: false, issuer: false }
OCSP request { cert: false, issuer: false }
closing...

--- Testing PFX+SNICRT ---
OCSP request { cert: false, issuer: false }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNIPFX ---
OCSP request { cert: false, issuer: false }
SNI 127.0.0.1
OCSP request { cert: false, issuer: false }
closing...

Done

On my server (Debian GNU/Linux 8, deb.nodesource.com/node_4.x):

$ node ocsptest.js 
Node version: v4.2.2 
... exactly same

VMware (Debian GNU/Linux 8, deb.nodesource.com/node_5.x):

$ node ocsptest.js 
Node version: v5.1.0 
... exactly same
@mscdex mscdex added the tls Issues and PRs related to the tls subsystem. label Dec 3, 2015
@mscdex
Copy link
Contributor

mscdex commented Dec 3, 2015

/cc @nodejs/crypto

@indutny
Copy link
Member

indutny commented Dec 5, 2015

Confirmed, working on a fix.

indutny added a commit to indutny/io.js that referenced this issue Dec 5, 2015
@indutny
crypto: load PFX chain the same way as regular one
d04c1f6 
Load the certificate chain from the PFX file the same as we do it for a
regular certificate chain.

Fix: nodejs#4127
@indutny indutny mentioned this issue Dec 5, 2015
Closed
@indutny
Copy link
Member

indutny commented Dec 5, 2015

@djphoenix may I ask you to give a try to this patch, please ? #4165

indutny added a commit to indutny/io.js that referenced this issue Dec 6, 2015
@indutny
test: add regression test for nodejs#4127
4e9d541
@djphoenix
Copy link
Contributor Author 

# ~/nodejs/node-v5.1.1/node ocsptest.js 
Node version: v5.1.1 
... same as reference

# ~/nodejs/node-v5.1.1-patched/node ocsptest.js 
Node version: v5.1.1 

--- Testing CER+KEY ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

Done

Perfect work, @indutny!

@djphoenix
Copy link
Contributor Author

Will fix release for 5.x only, or 4.x too?

@indutny
Copy link
Member

indutny commented Dec 7, 2015

@djphoenix 4.x too

Fishrock123 pushed a commit to Fishrock123/node that referenced this issue Dec 22, 2015
@indutny @Fishrock123
crypto: load PFX chain the same way as regular one
6406dbb 
Load the certificate chain from the PFX file the same as we do it for a
regular certificate chain.

Fix: nodejs#4127
PR-URL: nodejs#4165
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Fishrock123 pushed a commit to Fishrock123/node that referenced this issue Jan 6, 2016
@indutny @Fishrock123
crypto: load PFX chain the same way as regular one
fcf632b 
Load the certificate chain from the PFX file the same as we do it for a
regular certificate chain.

Fix: nodejs#4127
PR-URL: nodejs#4165
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
MylesBorins pushed a commit that referenced this issue Jan 13, 2016
@indutny
crypto: load PFX chain the same way as regular one
bb0a964 
Load the certificate chain from the PFX file the same as we do it for a
regular certificate chain.

Fix: #4127
PR-URL: #4165
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
@MylesBorins MylesBorins mentioned this issue Jan 13, 2016
Closed
MylesBorins pushed a commit that referenced this issue Jan 19, 2016
@indutny
crypto: load PFX chain the same way as regular one
d19da66 
Load the certificate chain from the PFX file the same as we do it for a
regular certificate chain.

Fix: #4127
PR-URL: #4165
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
scovetta pushed a commit to scovetta/node that referenced this issue Apr 2, 2016
@indutny
crypto: load PFX chain the same way as regular one
dacb2fc 
Load the certificate chain from the PFX file the same as we do it for a
regular certificate chain.

Fix: nodejs#4127
PR-URL: nodejs#4165
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
@snyk-bot snyk-bot mentioned this issue Jul 13, 2021
Open
@snyk-bot snyk-bot mentioned this issue Apr 30, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
tls Issues and PRs related to the tls subsystem.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@mscdex @indutny @djphoenix