Update ssl_engine_ocsp.c #501
Conversation
I have forced the addition of Nonce in OCSP requests to prevent replay attacks, ensuring that each OCSP request is unique, regardless of server configurations. This change increases security when checking certificate status.
| return NULL; | ||
| } | ||
|
|
||
| OCSP_request_add1_nonce(req, 0, -1); |
There was a problem hiding this comment.
Why ignore the opt-out config of SSLOCSPUseRequestNonce?
There was a problem hiding this comment.
The decision to enforce the inclusion of the nonce in OCSP requests, regardless of the SSLOCSPUseRequestNonce configuration, was made to enhance security. Nonce inclusion helps mitigate replay attacks, where a malicious actor might reuse a previously valid OCSP response to falsely indicate the validity of a revoked certificate.
By ensuring the nonce is always added, the integrity and freshness of the OCSP responses can be guaranteed. While this approach overrides the opt-out feature, it prioritizes preventing potential vulnerabilities.
| return req; | ||
| } | ||
|
|
||
| static int verify_ocsp_status(X509 *cert, X509_STORE_CTX *ctx, conn_rec *c, |
There was a problem hiding this comment.
This function looks duplicated.
There was a problem hiding this comment.
The create_request function is not duplicated. Returns req which is used later in verify_ocsp_status. The separation of the two functions is aimed at maintaining a clear division of responsibilities: create_request is responsible for generating the OCSP request, while verify_ocsp_status is responsible for verifying its status.
There was a problem hiding this comment.
I am referring to verify_ocsp_status(). The commit seems to add a second copy.
There was a problem hiding this comment.
I checked the code again and found no errors. Tell me if you don't understand something and I'll try to explain better.
I have forced the addition of Nonce in OCSP requests to prevent replay attacks, ensuring that each OCSP request is unique, regardless of server configurations. This change increases security when checking certificate status.