Problem - Kevin Tafuro

See Also
• RFC 3280: Internet X.509 Public Key Infrastructure Certificate and Certificate
Revocation List (CRL) Profile
• Recipes 9.4, 10.1, 10.6, 10.9, 10.10
10.12 Checking Revocation Status via OCSP with
OpenSSL
Problem
You have a certificate that you want to verify, as well as the certificate used to issue it
(and any others that may be in the certification path), but you need to check that the
certificates have not been revoked. One way to do this is to download the CRLfrom
the issuing CA, but an alternative is to check an OCSP responder for an immediate
response. Using OCSP allows you to avoid the overhead of downloading a potentially
very large CRL file.
Solution
Most CAs publish CRLs, but most do not run OCSP responders. A number of public
OCSP responders collect CRLs from a number of different CAs and are capable of
responding for each of them. Such responders are known as chain responders, and they
should only be trusted if their certificate can be verified or if it is trusted and it contains
the extKeyUsage extension with the OCSPSigning bit enabled. A reasonably up-to-date
list of these public responders is available from http://www.openvalidation.org. For
those CAs that run their own OCSP responders, it’s best to contact them directly
rather than relying on a chain responder, because the information from a CA’s
responder is more likely to be the most up-to-date.
In Recipe 10.10, we built a lookup table of various CAs that contains information
about where their CRLs can be found. You will notice that OCSP responder information
is also present for those CAs that have their own. At the time of this writing, the
only CA that has its own responder (so far as we have been able to determine) is
VeriSign.
Discussion
Checking a certificate’s revocation status using an OCSP responder requires three
things: the address of the OCSP responder, the certificate to be checked, and the certificate
that issued the certificate you want to check. With these three items,
OpenSSLmakes quick work of communicating with an OCSP responder. A number
562 | Chapter 10: Public Key Infrastructure
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.