yschimke
commented
4 years ago google.com
CN: *.google.com
Pin: sha256/cb2195483e8f601722fa673edaa01e3ac0a140774d8ee9aa1cfec10a0e886864
SAN: *.google.com, *.android.com, *.appengine.google.com, *.bdn.dev, *.cloud.google.com, *.crowdsource.google.com, *.datacompute.google.com, *.g.co, *.gcp.gvt2.com, *.gcpcdn.gvt1.com, *.ggpht.cn, *.gkecnapps.cn, *.google-analytics.com, *.google.ca, *.google.cl, *.google.co.in, *.google.co.jp, *.google.co.uk, *.google.com.ar, *.google.com.au, *.google.com.br, *.google.com.co, *.google.com.mx, *.google.com.tr, *.google.com.vn, *.google.de, *.google.es, *.google.fr, *.google.hu, *.google.it, *.google.nl, *.google.pl, *.google.pt, *.googleadapis.com, *.googleapis.cn, *.googlecnapps.cn, *.googlecommerce.com, *.googlevideo.com, *.gstatic.cn, *.gstatic.com, *.gstaticcnapps.cn, *.gvt1.com, *.gvt2.com, *.metric.gstatic.com, *.urchin.com, *.url.google.com, *.wear.gkecnapps.cn, *.youtube-nocookie.com, *.youtube.com, *.youtubeeducation.com, *.youtubekids.com, *.yt.be, *.ytimg.com, android.clients.google.com, android.com, developer.android.google.cn, developers.android.google.cn, g.co, ggpht.cn, gkecnapps.cn, goo.gl, google-analytics.com, google.com, googlecnapps.cn, googlecommerce.com, source.android.google.cn, urchin.com, www.goo.gl, youtu.be, youtube.com, youtubeeducation.com, youtubekids.com, yt.be
Key Usage: DigitalSignature
Ext Key Usage: serverAuth
Authority Info Access:
ocsp: http://ocsp.pki.goog/gts1o1core
caIssuers: http://pki.goog/gsr2/GTS1O1.crt
Valid: 2020-09-03T06:36:33Z..2020-11-26T06:36:33Z (1 months)
CA: false
CN: GTS CA 1O1
Pin: sha256/6193e04d9fb0a0d0820885b72c7d82c5078bcc1ff59b8d907024c149d81aca3b
SAN: <N/A>
Key Usage: DigitalSignature, KeyCertSign, CRLSign
Ext Key Usage: serverAuth, clientAuth
Authority Info Access:
ocsp: http://ocsp.pki.goog/gsr2
Valid: 2017-06-15T00:00:42Z..2021-12-15T00:00:42Z (1 years)
CA: true Max Intermediate: 0
CN: GlobalSign (signed by locally-trusted root)
Pin: sha256/8a27b5557b4bec7cc0305fbf3d53d1f71cd3f34910c5d65e27ecddb82077ba3d
SAN: <N/A>
OU: GlobalSign Root CA - R2
Key Usage: KeyCertSign, CRLSign
Valid: 2006-12-15T08:00:00Z..2021-12-15T08:00:00Z (1 years)
CA: true
OCSP status: GOOD
Working implementation of OCSP Client API and CLI checks.
Pro: If you are trying to work with certifikits, this is relevant particular if looking at behaviour with browsers which may do OCSP checks. Con: Adds a dependency on bouncycastle to certifikit-cli. We can work to remove that over time.
OpenJDK JSSE can do this with https://tersesystems.com/blog/2014/03/22/fixing-certificate-revocation/
But it's seemingly all or nothing, so will break other functionality.