search

ssllabs / ssllabs-scan

A command-line reference-implementation client for SSL Labs APIs, designed for automated and/or bulk testing.
https://www.ssllabs.com/projects/ssllabs-apis/
Apache License 2.0
1.69k stars 239 forks source link

CRL, OCSP and IPv6 #68

Open andrepereiradasilva opened 9 years ago

andrepereiradasilva commented 9 years ago

Hi Ivan,

In the API docs you have «ocspStapling - true if OCSP stapling is deployed on the server»

But many CA's doesn't have OCSP IPv6 responders. A nice list (probably outdated) in http://unmitigatedrisk.com/?p=147

So, reggarding this, if the server is:

Is this the result of the test? or ssl scan test doesn't test IPv6 OCSP?

A similiar case also for CRL in IPv6. For instance if a server is serving IPv6 and has a certificate from a CA with only IPv4 CRL, should this server be considered exceptional?

Also if a server has IPv6 shouldn't the endpoints IPv6 also be in the API JSON result (ex: "ipv6Address")?

Thanks

ivanr commented 9 years ago

Why is it relevant that a CA has IPv6 OCSP and CRL infrastructure?

andrepereiradasilva commented 9 years ago

For what i understand, when OCSP stapling is implemented the web server queries the OCSP server and the response is "stapled" in the tls handshake.

When OCSP stapling is configured in the server, if the server is pure IPv6 doesn't it try to communicate via IPv6 with the OCSP server? If so, if the server is IPv6 and the CA OCSP is only IPv4, it will not work, right? I don't see many cases for this now, but with IPv4 exaustion, i guess it will happen more in the future.

Also if a client only has IPv6? How will he connect to the OCSP server if it doesn't support IPv4? The GlobalSign SSL Check Test (that i think is based on Qualys test), tests IPv6 OCSP support. They have an explanation why they do the test: «We have detected that your site is available over IPv6 but your site's certificate contains references to servers that do not support IPv6. This means that despite your organization having done the work to support IPv6, users who can only communicate over IPv6 would experience errors when visiting your site.» Source: https://sslcheck.globalsign.com/en/help/c15b8d74

I don't think it's a priority but it would be good to test OCSP IPv6 support in the future. I see this like a feature for the future, not a bug.

ivanr commented 9 years ago

I understand. We don't test IPv6 at all now, but that should change soon. I'll consider this ticket then.

andrepereiradasilva commented 9 years ago

ivanr, another thing i remembered is that you can have the same server with SNI for IPv4 and without SNI for IPv6, since a provider can give one IPv4 and a lots of IPv6 for the same server, like DO for instance. So i'm guessing if the IPv6 test shouldn't be considered an individual different endpoint.

selecadm commented 9 years ago

GlobalSign warns about CRL and OCSP inaccessibility over IPv6 primarily because their own servers support IPv6.

Comodo made the servers available over IPv6 on 15 February 2015.

Who else?

andrepereiradasilva commented 9 years ago

Yes, Globalsign and Comodo seem to be the only ones: http://ip6.nl/#!ocsp.globalsign.com | http://ip6.nl/#!crl.globalsign.com http://ip6.nl/#!ocsp.comodoca.com | http://ip6.nl/#!crl.comodoca.com

Entrust as some IPv6 capability, but doesn't seem to have full support http://ip6.nl/#!ocsp.entrust.net | http://ip6.nl/#!crl.entrust.net

Don't know other that provides OCSP/CRL in IPv6.