You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by jean-frederic clere <jf...@gmail.com> on 2021/06/29 11:29:17 UTC
certificateVerification="optionalNoCA" and OCSP validation.
Hi,
It seems certificateVerification="optionalNoCA" only works if the OCSP
is disabled.
<OpenSSLConf>
<OpenSSLConfCmd name="NO_OCSP_CHECK" value="true" />
</OpenSSLConf>
In <SSLHostConfig/>
Otherwise the OCSP check forces an error because it can't check anything...
How to "fix" that? Just document it? or return OK where we test
SSL_CVERIFY_OPTIONAL_NO_CA
(https://github.com/apache/tomcat-native/blob/main/native/src/sslutils.c#L337)?
--
Cheers
Jean-Frederic
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: certificateVerification="optionalNoCA" and OCSP validation.
Posted by Michael Osipov <mi...@apache.org>.
On 2023/09/26 10:48:23 Mark Thomas wrote:
> Hi,
>
> This is an old thread (2021) but relevant to BZ 67061 [1].
>
> In short, optionalNoCA doesn't work unless OCSP is also disabled.
>
> Do we:
>
> a) Always skip the OCSP check if optionalNoCA is used (and document this
> for optionalNoCA)?
>
> b) Leave the code unchanged and document that using optionalNoCA also
> requires OCSP to be explicitly disabled?
>
> My understanding from the 2021 thread is that we agreed to implement a)
> although it looks like that never happened.
>
> Unless there are objections, I intend to implement a) shortly.
I tripped over this two years ago and was suprised was the Tomcat responses are so slow, it turned out:
* our OCSP responder was abysmally slow
* OCSP check was *enabled* by default and only a hack by Rainer did disable it.
I would highly prefer that we have the logical equivalent of https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslocspenable (attribute "ocspEnable" or alike in consistence of other attributes), not even speaking about the other options.
Michael
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: certificateVerification="optionalNoCA" and OCSP validation.
Posted by Mark Thomas <ma...@apache.org>.
Hi,
This is an old thread (2021) but relevant to BZ 67061 [1].
In short, optionalNoCA doesn't work unless OCSP is also disabled.
Do we:
a) Always skip the OCSP check if optionalNoCA is used (and document this
for optionalNoCA)?
b) Leave the code unchanged and document that using optionalNoCA also
requires OCSP to be explicitly disabled?
My understanding from the 2021 thread is that we agreed to implement a)
although it looks like that never happened.
Unless there are objections, I intend to implement a) shortly.
Mark
[1] https://bz.apache.org/bugzilla/show_bug.cgi?id=67061
On 30/06/2021 15:09, jean-frederic clere wrote:
> On 29/06/2021 18:22, Mark Thomas wrote:
>> On 29/06/2021 15:19, jean-frederic clere wrote:
>>> On 29/06/2021 14:45, Mark Thomas wrote:
>>>> On 29/06/2021 12:29, jean-frederic clere wrote:
>>>>> Hi,
>>>>>
>>>>> It seems certificateVerification="optionalNoCA" only works if the
>>>>> OCSP is disabled.
>>>>> <OpenSSLConf>
>>>>> <OpenSSLConfCmd name="NO_OCSP_CHECK" value="true" />
>>>>> </OpenSSLConf>
>>>>> In <SSLHostConfig/>
>>>>>
>>>>> Otherwise the OCSP check forces an error because it can't check
>>>>> anything...
>>>>>
>>>>> How to "fix" that? Just document it? or return OK where we test
>>>>> SSL_CVERIFY_OPTIONAL_NO_CA
>>>>> (https://github.com/apache/tomcat-native/blob/main/native/src/sslutils.c#L337)?
>>>>
>>>> Hmm.
>>>>
>>>> My expectation is that:
>>>>
>>>> - certificate provided results in OCSP for that cert and the connection
>>>> fails if the check fails.
>>>
>>> certificateVerification="optional" makes the client certificate
>>> optional (required by webapps if needed).
>>>
>>> certificateVerification="optionalNoCA" does the same and additionally
>>> should avoid checking the client against the CA.
>>> The OCSP checking needs to validate the client certificate against
>>> the CA otherwise it will prevent getting the connection, making NoCA
>>> like ignored...
>>
>> Got it. In which case I'll change my expectation to optionalNoCA == no
>> OCSP check. We should document this.
>
> OK I will fix the code and document it.
>
>>
>> Mark
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: dev-help@tomcat.apache.org
>>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: certificateVerification="optionalNoCA" and OCSP validation.
Posted by jean-frederic clere <jf...@gmail.com>.
On 29/06/2021 18:22, Mark Thomas wrote:
> On 29/06/2021 15:19, jean-frederic clere wrote:
>> On 29/06/2021 14:45, Mark Thomas wrote:
>>> On 29/06/2021 12:29, jean-frederic clere wrote:
>>>> Hi,
>>>>
>>>> It seems certificateVerification="optionalNoCA" only works if the
>>>> OCSP is disabled.
>>>> <OpenSSLConf>
>>>> <OpenSSLConfCmd name="NO_OCSP_CHECK" value="true" />
>>>> </OpenSSLConf>
>>>> In <SSLHostConfig/>
>>>>
>>>> Otherwise the OCSP check forces an error because it can't check
>>>> anything...
>>>>
>>>> How to "fix" that? Just document it? or return OK where we test
>>>> SSL_CVERIFY_OPTIONAL_NO_CA
>>>> (https://github.com/apache/tomcat-native/blob/main/native/src/sslutils.c#L337)?
>>>>
>>>
>>> Hmm.
>>>
>>> My expectation is that:
>>>
>>> - certificate provided results in OCSP for that cert and the connection
>>> fails if the check fails.
>>
>> certificateVerification="optional" makes the client certificate
>> optional (required by webapps if needed).
>>
>> certificateVerification="optionalNoCA" does the same and additionally
>> should avoid checking the client against the CA.
>> The OCSP checking needs to validate the client certificate against the
>> CA otherwise it will prevent getting the connection, making NoCA like
>> ignored...
>
> Got it. In which case I'll change my expectation to optionalNoCA == no
> OCSP check. We should document this.
OK I will fix the code and document it.
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
--
Cheers
Jean-Frederic
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: certificateVerification="optionalNoCA" and OCSP validation.
Posted by Mark Thomas <ma...@apache.org>.
On 29/06/2021 15:19, jean-frederic clere wrote:
> On 29/06/2021 14:45, Mark Thomas wrote:
>> On 29/06/2021 12:29, jean-frederic clere wrote:
>>> Hi,
>>>
>>> It seems certificateVerification="optionalNoCA" only works if the
>>> OCSP is disabled.
>>> <OpenSSLConf>
>>> <OpenSSLConfCmd name="NO_OCSP_CHECK" value="true" />
>>> </OpenSSLConf>
>>> In <SSLHostConfig/>
>>>
>>> Otherwise the OCSP check forces an error because it can't check
>>> anything...
>>>
>>> How to "fix" that? Just document it? or return OK where we test
>>> SSL_CVERIFY_OPTIONAL_NO_CA
>>> (https://github.com/apache/tomcat-native/blob/main/native/src/sslutils.c#L337)?
>>>
>>
>> Hmm.
>>
>> My expectation is that:
>>
>> - certificate provided results in OCSP for that cert and the connection
>> fails if the check fails.
>
> certificateVerification="optional" makes the client certificate optional
> (required by webapps if needed).
>
> certificateVerification="optionalNoCA" does the same and additionally
> should avoid checking the client against the CA.
> The OCSP checking needs to validate the client certificate against the
> CA otherwise it will prevent getting the connection, making NoCA like
> ignored...
Got it. In which case I'll change my expectation to optionalNoCA == no
OCSP check. We should document this.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: certificateVerification="optionalNoCA" and OCSP validation.
Posted by jean-frederic clere <jf...@gmail.com>.
On 29/06/2021 14:45, Mark Thomas wrote:
> On 29/06/2021 12:29, jean-frederic clere wrote:
>> Hi,
>>
>> It seems certificateVerification="optionalNoCA" only works if the OCSP
>> is disabled.
>> <OpenSSLConf>
>> <OpenSSLConfCmd name="NO_OCSP_CHECK" value="true" />
>> </OpenSSLConf>
>> In <SSLHostConfig/>
>>
>> Otherwise the OCSP check forces an error because it can't check
>> anything...
>>
>> How to "fix" that? Just document it? or return OK where we test
>> SSL_CVERIFY_OPTIONAL_NO_CA
>> (https://github.com/apache/tomcat-native/blob/main/native/src/sslutils.c#L337)?
>>
>
> Hmm.
>
> My expectation is that:
>
> - certificate provided results in OCSP for that cert and the connection
> fails if the check fails.
certificateVerification="optional" makes the client certificate optional
(required by webapps if needed).
certificateVerification="optionalNoCA" does the same and additionally
should avoid checking the client against the CA.
The OCSP checking needs to validate the client certificate against the
CA otherwise it will prevent getting the connection, making NoCA like
ignored...
>
> - no cert, no check
>
> I don't know how practical that is. What does OpenSSL do in those
> circumstances? Or is it up to the application using the OpenSSL library?
It is up to the application.
Note when using SSLOCSPEnable on, Httpd is behaving like Tomcat, but
SSLOCSPEnable default is off. So in Httpd SSLVerifyClient optional_no_ca
works by default and certificateVerification="optionalNoCA" doesn't in
Tomcat.
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
--
Cheers
Jean-Frederic
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: certificateVerification="optionalNoCA" and OCSP validation.
Posted by Mark Thomas <ma...@apache.org>.
On 29/06/2021 12:29, jean-frederic clere wrote:
> Hi,
>
> It seems certificateVerification="optionalNoCA" only works if the OCSP
> is disabled.
> <OpenSSLConf>
> <OpenSSLConfCmd name="NO_OCSP_CHECK" value="true" />
> </OpenSSLConf>
> In <SSLHostConfig/>
>
> Otherwise the OCSP check forces an error because it can't check anything...
>
> How to "fix" that? Just document it? or return OK where we test
> SSL_CVERIFY_OPTIONAL_NO_CA
> (https://github.com/apache/tomcat-native/blob/main/native/src/sslutils.c#L337)?
Hmm.
My expectation is that:
- certificate provided results in OCSP for that cert and the connection
fails if the check fails.
- no cert, no check
I don't know how practical that is. What does OpenSSL do in those
circumstances? Or is it up to the application using the OpenSSL library?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org