Hello!

Here are patches for OCSP stapling support. Testing and
review appreciated.

New directives:

ssl_trusted_certificate /path/to/file;

Specifies a file with CA certificates in the PEM format used for
certificate verification. In contrast to ssl_client_certificate, DNs
of these certificates aren't sent to a client in CertificateRequest.

ssl_stapling on|off;

Activates OCSP stapling.

ssl_stapling_file /path/to/file;

Use predefined OCSP response for stapling, do not query responder.
Assumes OCSP response in DER format as produced by "openssl ocsp".

ssl_stapling_responder URL;

Use specified OCSP responder instead of one found in AIA certificate
extension.

Example configuration:

server {
listen 443 ssl;

ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/key.pem;

ssl_stapling on;
ssl_trusted_certificate /path/to/ca.pem;

resolver 8.8.8.8;
}

Known limitations:

- Unless externally set OCSP response is used (via the "ssl_stapling_file"
directive), stapled response won't be sent in a first connection. This
is due to the fact that OCSP responders are currently queried by nginx
once it receives connection with certificate_status extension in ClientHello,
and due to limitations in OpenSSL API (certificate status callback is
blocking).

- Cached OCSP responses are currently stored in local process memory (thus
each worker process will query OCSP responders independently). This
shouldn't be a problem as typical number of worker processes is low, usually
set match number of CPUs.

- Various timeouts are hardcoded (connect/read/write timeouts are 60s,
response is considered to be valid for 1h after loading). Adding
configuration directives to control these would be trivial, but it may
be a better idea to actually omit them for simplicity.

- Only "http://" OCSP responders are recognized.

Patch can be found here:

http://nginx.org/patches/ocsp-stapling/

Thanks to Comodo, DigiCert and GlobalSign for sponsoring this work.

Maxim Dounin

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel