svn commit: r1772627 - /serf/branches/ocsp-verification/BRANCH-README

[br...@apache.org]

Author: brane
Date: Mon Dec  5 10:30:12 2016
New Revision: 1772627

URL: http://svn.apache.org/viewvc?rev=1772627&view=rev
Log:
On the ocsp-verification branch: Add branch docs.

* BRANCH-README: New file.

Added:
    serf/branches/ocsp-verification/BRANCH-README   (with props)

Added: serf/branches/ocsp-verification/BRANCH-README
URL: http://svn.apache.org/viewvc/serf/branches/ocsp-verification/BRANCH-README?rev=1772627&view=auto
==============================================================================
--- serf/branches/ocsp-verification/BRANCH-README (added)
+++ serf/branches/ocsp-verification/BRANCH-README Mon Dec  5 10:30:12 2016
@@ -0,0 +1,52 @@
+Support for OCSP Verification in Serf
+=====================================
+
+Serf trunk currently supports OCSP stapling for verifying server
+certificates. The purpose of this branch is to add minimal support
+for issuing OCSP requests to responders from the client application.
+
+The idea is that the application decides when and where to send OCSP
+requests and how to verify responses, and Serf provides some basic
+utility functions for constructing the requests and parsing the
+responses.
+
+These are the proposed changes:
+
+1. serf_ssl_cert_certificate()
+
+   Extract the OCSP responder URL from the certificate's x509v3
+   extension field authorityInfoAccess:OCSP;URI and, if it is
+   present, insert it into the returned hash table with key
+   "ocsp.uri".
+
+2. serf_ssl_cert_import()
+
+   Add new function that is the inverse of serf_ssl_cert_export():
+
+       serf_ssl_certificate_t *serf_ssl_cert_import(
+           const char *encoded_cert,
+           apr_pool_t *pool);
+
+   Imports certificate from a base64-encoded, zero-terminated
+   string. The returned certificate is allocated in @a pool.
+   Returns NULL on failure.
+
+3. serf_ocsp_request_setup()
+
+   Add a new function that can be used from within a request setup
+   handler to create an OCSP request bucket:
+
+       apr_status_t serf_ocsp_request_setup(
+           serf_request_t *request,
+           const serf_ssl_certificate_t *server_cert,
+           const serf_ssl_certificate_t *issuer_cert,
+           serf_bucket_t **req_bkt,
+           apr_pool_t *pool);
+
+   Constructs an OCSP verification request for @a server_cert
+   with issuer certificate @a issuer_cert and sets the required
+   headers on @a request, returning the request bucket @a req_bkt.
+
+4. serf_ocsp_response_parse()
+
+   TBD: Parse an OCSP response.

Propchange: serf/branches/ocsp-verification/BRANCH-README
------------------------------------------------------------------------------
    svn:eol-style = native