Welcome! Log In Create A New Profile

Advanced

ssl_stapling without ssl_trusted_certificate

sergio
March 31, 2019 02:12PM
Вот тут
https://nginx.org/en/docs/http/ngx_http_ssl_module.html
написано:

For the OCSP stapling to work, the certificate of the server certificate
issuer should be known. If the ssl_certificate file does not contain
intermediate certificates, the certificate of the server certificate
issuer should be present in the ssl_trusted_certificate file.

For a resolution of the OCSP responder hostname, the resolver directive
should also be specified.

И ещё:

For verification to work, the certificate of the server certificate
issuer, the root certificate, and all intermediate certificates should
be configured as trusted using the ssl_trusted_certificate directive.

По-этому я взял и сделал всё ровно наоборот: не стал указывать ни
resolver ни ssl_trusted_certificate. Включил только лишь:
ssl_stapling on;
ssl_stapling_verify on;
И мои сертификаты не содержат цепочки доверия, только лишь сам сертификат.

1. Почему ocsp работает и это не отражено в документации?
(я вижу OCSP Response Data в openssl s_client -connect hostname:443
-tls1_2 -tlsextdebug -status)
2. Как вычисляются значения resolver и ssl_trusted_certificate, когда
они не указаны?

nginx 1.14.1-1~bpo9+1 stretch-backports

--
sergio.
_______________________________________________
nginx-ru mailing list
nginx-ru@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-ru
Subject Author Posted

ssl_stapling without ssl_trusted_certificate

sergio March 31, 2019 02:12PM

Re: ssl_stapling without ssl_trusted_certificate

Maxim Dounin April 01, 2019 08:56AM

Re: ssl_stapling without ssl_trusted_certificate

sergio April 01, 2019 09:30AM

Re: ssl_stapling without ssl_trusted_certificate

Maxim Dounin April 01, 2019 10:46AM

Re: ssl_stapling without ssl_trusted_certificate

sergio April 01, 2019 11:16AM

Re: ssl_stapling without ssl_trusted_certificate

Maxim Dounin April 01, 2019 12:24PM

Re: ssl_stapling without ssl_trusted_certificate

sergio via nginx-ru April 10, 2019 08:56PM

Re: ssl_stapling without ssl_trusted_certificate

Maxim Dounin April 11, 2019 03:58PM

Re: ssl_stapling without ssl_trusted_certificate

sergio via nginx-ru April 11, 2019 05:04PM

Re: ssl_stapling without ssl_trusted_certificate

Maxim Dounin April 12, 2019 09:36AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 96
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready