Add OCSP Stapling #1275
Add OCSP Stapling #1275
Conversation
|
Not sure about this, OCSP is more and more disabled and CRLs are recommended for privacy reasons. |
maximilianfridrich
force-pushed
the
ocsp_stapling
branch
from
da0d72a to
41c901d
Compare
|
You're right, some CAs move away from OCSP (even OCSP stapling). Let's Encrypt for example can afford this because they operate very efficiently by enforcing ACME and only issuing short-lived certificates. Not everyone is in such a position (yet) where they can afford to drop OCSP and instead only use CRLs which has its own (long) list of drawbacks. Certificate revocation is still a difficult topic with no clear cut solution. RFC 9325 (section 7.5) provides some guidance and does suggest OCSP, particularly OCSP stapling since it solves the privacy issues around OCSP. Per default, this is disabled, so no-one has to use it if they don't want to. |
maximilianfridrich
force-pushed
the
ocsp_stapling
branch
4 times, most recently
from
85c2afc to
d95fa1c
Compare
| *cert = SSL_get1_peer_certificate(ssl); | ||
| #else | ||
| *cert = SSL_get_peer_certificate(ssl); | ||
| #endif |
There was a problem hiding this comment.
could this be a good time to drop support for OpenSSL 1.1.1 ?
There was a problem hiding this comment.
I'm pretty sure we still have systems using OpenSSL 1.1.1.
If you want to discuss this, I think opening a GitHub discussion in baresip or re and tagging all major contributors and all maintainers could be good.
src/tls/openssl/tls.c
Outdated
| * | ||
| * @return 0 if success, otherwise errorcode | ||
| */ | ||
| int tls_set_ocsp_stapling(struct tls *tls, const enum tls_ocsp_stapling mode) |
There was a problem hiding this comment.
have this been tested with LibreSSL ?
There was a problem hiding this comment.
At least through the retest, yes. Initially, I had used some OpenSSL functions which were not supported by LibreSSL, and the retest showed this, so I refactored it. So I'm pretty sure that this also works with LibreSSL.
maximilianfridrich
force-pushed
the
ocsp_stapling
branch
from
d95fa1c to
ce8b166
Compare
maximilianfridrich
force-pushed
the
ocsp_stapling
branch
from
ce8b166 to
b9efd5c
Compare
|
it looks like the run-on-arch job is failing: Should we try to switch to |
|
Thanks @ everyone for the feedback and patience. As mentioned in the BareSIP PR, I will close this and we will look into a CRLDP implementation. |
The test only checks for basic functionality. This was tested successfully manually with a real TLS server which provides OCSP stapling responses (
duck.com:443).Related: