[prev in list] [next in list] [prev in thread] [next in thread]
List: stunnel-users
Subject: Re: [stunnel-users] OCSP Responders in AIA extension
From: Ender Erel <ender.erel () icterra ! com>
Date: 2014-01-22 15:55:13
Message-ID: 2170f8fa96fe4e7cae685c69b5d598ae () AMSPR02MB038 ! eurprd02 ! prod ! outlook ! com
[Download RAW message or body]
Thanks for the feedback, I really appreciate it.
I just have one more question. Let's say the server presents a certificate chain, and \
the order of certificates in the pem file I saved is different than how the server \
presented it. Would the connection still be successful? Or is the order of the \
certificates in the pem file important?
Regards,
Ender
From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Michal \
Trojnara
Sent: Wednesday, January 22, 2014 12:59 AM
To: stunnel-users@stunnel.org
Subject: Re: [stunnel-users] OCSP Responders in AIA extension
Hi Ender,
The AIA extension is indeed currently ignored by stunnel.
This feature is on my TODO list. I hope to find time to implement it.
I cannot just apply the patch, as it doesn't have a license. I also don't accept \
copyleft (e.g. GPL) patches.
The configuration you described seems to be correct.
Mike
On 2014-01-20 14:22, Ender Erel wrote:
I am sorry, it seems I forgot the link to the e-mail I mentioned.
https://www.stunnel.org/pipermail/stunnel-users/2008-July/002068.html
Any ideas?
Regards,
Ender Erel
From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Ender \
Erel
Sent: Friday, January 17, 2014 3:31 PM
To: stunnel-users@stunnel.org<mailto:stunnel-users@stunnel.org>
Subject: [stunnel-users] OCSP Responders in AIA extension
Hi All,
Does stunnel check the OCSP responders found in a certificate's AIA field? I am \
asking this because in the following e-mail from back 2008, the sender mentions a \
patch that implements this functionality. The patch is included with the mail but I \
don't think it is included in the later versions of stunnel. Does this mean OCSP \
responders inside a receied certificate are ignored?
I also want to ask another thing. When using verify = 3 in client mode, which file is \
used to check the received certificate? Is it the CAfile? If so, would it work like \
this:
- I manually opened a connection to a server outside stunnel, downloaded the \
server's certificate, and closed the connection.
- I saved this certificate to a file, and wrote the path of this file in the \
stunnel configuration file (CAfile = /mycerts/tmpcert.pem,verify=3).
- I started stunnel and initiated a connection to the server.
Would the connection be successful? Would it be the right way to use verify=3?
Kind Regards,
Ender Erel
_______________________________________________
stunnel-users mailing list
stunnel-users@stunnel.org<mailto:stunnel-users@stunnel.org>
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
[Attachment #3 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;
mso-fareast-language:EN-US;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;
mso-fareast-language:EN-US;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:458914819;
mso-list-type:hybrid;
mso-list-template-ids:-18447212 1482349524 69140483 69140485 69140481 69140483 \
69140485 69140481 69140483 69140485;} @list l0:level1
{mso-level-start-at:16;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="TR" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Thanks for the feedback, I really \
appreciate it.<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span \
style="color:#1F497D">I just have one more question. Let’s say the server \
presents a certificate chain, and the order of certificates in the pem file I saved \
is different than how the server presented it. Would the connection still be \
successful? Or is the order of the certificates in the pem file \
important?<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span \
style="color:#1F497D">Regards,<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="color:#1F497D">Ender<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="color:#1F497D"><o:p> </o:p></span></p> <div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" \
style="color:windowtext;mso-fareast-language:TR">From:</span></b><span lang="EN-US" \
style="color:windowtext;mso-fareast-language:TR"> stunnel-users \
[mailto:stunnel-users-bounces@stunnel.org] <b>On Behalf Of </b>Michal Trojnara<br>
<b>Sent:</b> Wednesday, January 22, 2014 12:59 AM<br>
<b>To:</b> stunnel-users@stunnel.org<br>
<b>Subject:</b> Re: [stunnel-users] OCSP Responders in AIA \
extension<o:p></o:p></span></p> </div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Ender,<br>
<br>
The AIA extension is indeed currently ignored by stunnel.<br>
This feature is on my TODO list. I hope to find time to implement it.<br>
I cannot just apply the patch, as it doesn't have a license. I also don't \
accept copyleft (e.g. GPL) patches.<br> <br>
The configuration you described seems to be correct.<br>
<br>
Mike<br>
<br>
On 2014-01-20 14:22, Ender Erel wrote:<span \
style="font-size:12.0pt;mso-fareast-language:TR"><o:p></o:p></span></p> </div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="color:#1F497D">I am sorry, it seems I forgot the \
link to the e-mail I mentioned.</span><o:p></o:p></p> <p class="MsoNormal"><span \
style="color:#1F497D"> </span><o:p></o:p></p> <p class="MsoNormal"><a \
href="https://www.stunnel.org/pipermail/stunnel-users/2008-July/002068.html">https://www.stunnel.org/pipermail/stunnel-users/2008-July/002068.html</a><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Any ideas?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Ender Erel</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" \
style="mso-fareast-language:TR">From:</span></b><span lang="EN-US" \
style="mso-fareast-language:TR"> stunnel-users [<a \
href="mailto:stunnel-users-bounces@stunnel.org">mailto:stunnel-users-bounces@stunnel.org</a>]
<b>On Behalf Of </b>Ender Erel<br>
<b>Sent:</b> Friday, January 17, 2014 3:31 PM<br>
<b>To:</b> <a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><br>
<b>Subject:</b> [stunnel-users] OCSP Responders in AIA \
extension</span><o:p></o:p></p> </div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Hi All,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Does stunnel check the OCSP responders found in a \
certificate’s AIA field? I am asking this because in the following e-mail from \
back 2008, the sender mentions a patch that implements this functionality. The patch \
is included with the mail but I don’t think it is included in the later \
versions of stunnel. Does this mean OCSP responders inside a receied certificate are \
ignored?<o:p></o:p></p> <p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I also want to ask another thing. When using verify = 3 in \
client mode, which file is used to check the received certificate? Is it the \
CAfile?<o:p></o:p></p> <p class="MsoNormal">If so, would it work like \
this:<o:p></o:p></p> <p class="MsoListParagraph" \
style="text-indent:-18.0pt;mso-list:l0 level1 lfo2"><![if !supportLists]><span \
style="mso-list:Ignore">-<span style="font:7.0pt "Times New \
Roman""> \
</span></span><![endif]>I manually opened a connection to a server outside stunnel, \
downloaded the server’s certificate, and closed the connection.<o:p></o:p></p> \
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo2"><![if \
!supportLists]><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New \
Roman""> \
</span></span><![endif]>I saved this certificate to a file, and wrote the path of \
this file in the stunnel configuration file (CAfile = \
/mycerts/tmpcert.pem,verify=3).<o:p></o:p></p> <p class="MsoListParagraph" \
style="text-indent:-18.0pt;mso-list:l0 level1 lfo2"><![if !supportLists]><span \
style="mso-list:Ignore">-<span style="font:7.0pt "Times New \
Roman""> \
</span></span><![endif]>I started stunnel and initiated a connection to the \
server.<o:p></o:p></p> <p class="MsoNormal">Would the connection be successful? Would \
it be the right way to use verify=3? <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Kind Regards,<o:p></o:p></p>
<p class="MsoNormal">Ender Erel<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New \
Roman","serif";mso-fareast-language:TR"><br> <br>
<br>
<o:p></o:p></span></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>stunnel-users mailing list<o:p></o:p></pre>
<pre><a href="mailto:stunnel-users@stunnel.org">stunnel-users@stunnel.org</a><o:p></o:p></pre>
<pre><a href="https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users">https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New \
Roman","serif";mso-fareast-language:TR"><o:p> </o:p></span></p> \
</div> </body>
</html>
_______________________________________________
stunnel-users mailing list
stunnel-users@stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
--===============4067382691362143835==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic