search

r509 / r509-ocsp-responder

An OCSP responder written in Ruby. Uses r509 and Sinatra.
http://langui.sh
Other
31 stars 17 forks source link

OCSP responder on dedicated server #15

Closed tisrnd closed 8 years ago

tisrnd commented 8 years ago

Hi! I am trying to build CA stack.

Previously I've been following your tutorial "Building a CA (r509 Howto)" and succeeded at getting up r509-ca-http + r509-ocsp-responder on a same server. Everything worked fine, OCSP was returning VALID and REVOKED for my certificates. For r509-ocsp-responder I've used this config:

copy_nonce: true cache_headers: true max_cache_age: 60 certificate_authorities: r509_howto_ca: ca_cert: cert: spec/fixtures/r509_howto_ca.cer key: spec/fixtures/r509_howto_ca.key

But right now I want to split up r509-http and ocsp. After setting up those on different servers I've started to receiving UNKNOWN and realized that both those instances using their local Redis database and don't share data between each other. So ocsp doesn't know that cert has been revoked or unrevoked.

In your tutorial I've seen that you've mentioned "OCSP signing delegates"

We are going to use the root to sign responses for our OCSP responder. This is not considered best practice for a variety of reasons, but it will simplify our setup. We'll cover OCSP signing delegates in another post.

I've tried to look up any info about it, googled within your site and but haven't found anything.

Config for r509-ocsp-responder in dedicated server I tried to use:

copy_nonce: true cache_headers: true max_cache_age: 60 certificate_authorities: r509_howto_ca: ca_cert: cert: spec/fixtures/r509_howto_ca.cer ocsp_cert: cert: spec/fixtures/ocsp.cer key: spec/fixtures/ocsp.key

Key's for OCSP I've generated this way (probably I did mistake here):

r509 --keyout ocsp.key --subject "/CN=ocsp/O=ocsp test"

Maybe I need to find a way to share redis instance for both servers? Can you help me with these and give some advises on what am I missing? Because I think that I might be going wrong direction trying to get this done.

reaperhulk commented 8 years ago

An OCSP signing certificate is a cert cut off the authority that you want to sign for. It needs an extendedKeyUsage of OCSPSigning and typically also has the OCSPNoCheck extension.

If you want to share revocation/issuance information with multiple r509-ocsp-responder instances you are correct that you'll need to either use a shared redis instance or else write some code to publish the information to each redis. At my old job we built a pub/sub where each responder would subscribe to issuance/revocation events so there was a local copy of all the data.

Take a look at how you're writing that information right now (probably with https://github.com/r509/r509-validity-redis ?) and adapt it to your needs.

tisrnd commented 8 years ago

Thanks for your help!