From 7d179c1e4c1d330086549ea104fda98aafb9058b Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Wed, 17 Sep 2025 20:32:18 +0200 Subject: [PATCH 01/10] Feat: Adds OCSP stapling example Adds OCSP stapling client and server examples with dynamic certs. This allows testing and demonstrating OCSP stapling functionality. --- .gitignore | 3 +- ocsp/stapling/Makefile | 42 ++ .../client-certs/intermediate1-ca-cert.pem | 184 +++++++++ ocsp/stapling/client-certs/root-ca-cert.pem | 92 +++++ ocsp/stapling/ocsp-client.c | 231 +++++++++++ ocsp/stapling/ocsp-server.c | 390 ++++++++++++++++++ ocsp/stapling/responder-certs/index.txt | 1 + .../responder-certs/ocsp-responder-cert.pem | 181 ++++++++ .../responder-certs/ocsp-responder-key.pem | 27 ++ ocsp/stapling/server-certs/server1-cert.pem | 276 +++++++++++++ ocsp/stapling/server-certs/server1-key.pem | 28 ++ 11 files changed, 1454 insertions(+), 1 deletion(-) create mode 100644 ocsp/stapling/Makefile create mode 100644 ocsp/stapling/client-certs/intermediate1-ca-cert.pem create mode 100644 ocsp/stapling/client-certs/root-ca-cert.pem create mode 100644 ocsp/stapling/ocsp-client.c create mode 100644 ocsp/stapling/ocsp-server.c create mode 100644 ocsp/stapling/responder-certs/index.txt create mode 100644 ocsp/stapling/responder-certs/ocsp-responder-cert.pem create mode 100644 ocsp/stapling/responder-certs/ocsp-responder-key.pem create mode 100644 ocsp/stapling/server-certs/server1-cert.pem create mode 100644 ocsp/stapling/server-certs/server1-key.pem diff --git a/.gitignore b/.gitignore index 5a3dcc33..709529ce 100644 --- a/.gitignore +++ b/.gitignore @@ -301,6 +301,8 @@ hash/sha3-256-hash-string hash/sha512-hash ocsp/ocsp_nonblock/ocsp_nonblock +ocsp/stapling/ocsp-client +ocsp/stapling/ocsp-server sslkeylog.log @@ -380,4 +382,3 @@ tpm/evp_tpm /Arduino/**/.visualgdb/* /Arduino/sketches/output.log /**/*.bak - diff --git a/ocsp/stapling/Makefile b/ocsp/stapling/Makefile new file mode 100644 index 00000000..6602ccc0 --- /dev/null +++ b/ocsp/stapling/Makefile @@ -0,0 +1,42 @@ +# Examples Makefile +CC = gcc +WOLFSSL_INSTALL_DIR = /usr/local +CFLAGS = -Wall -I$(WOLFSSL_INSTALL_DIR)/include +LIBS = -L$(WOLFSSL_INSTALL_DIR)/lib + +# option variables +DYN_LIB = -lwolfssl +STATIC_LIB = $(WOLFSSL_INSTALL_DIR)/lib/libwolfssl.a +DEBUG_FLAGS = -g3 -O0 -DDEBUG +DEBUG_INC_PATHS = -MD +OPTIMIZE = -O2 + +# Options +CFLAGS+=$(DEBUG_FLAGS) +#CFLAGS+=$(OPTIMIZE) +#LIBS+=$(STATIC_LIB) +LIBS+=$(DYN_LIB) + +# build targets +SRC=$(wildcard *.c) +TARGETS=$(patsubst %.c, %, $(SRC)) + +.PHONY: clean all + +all: $(TARGETS) + +debug: CFLAGS+=$(DEBUG_FLAGS) +debug: all + +# build template +%: %.c + $(CC) -o $@ $< $(CFLAGS) $(LIBS) + +responder: + openssl ocsp -index responder-certs/index.txt -port 22221 \ + -rsigner responder-certs/ocsp-responder-cert.pem \ + -rkey \responder-certs/ocsp-responder-key.pem \ + -CA client-certs/intermediate1-ca-cert.pem + +clean: + rm -f $(TARGETS) diff --git a/ocsp/stapling/client-certs/intermediate1-ca-cert.pem b/ocsp/stapling/client-certs/intermediate1-ca-cert.pem new file mode 100644 index 00000000..911cce43 --- /dev/null +++ b/ocsp/stapling/client-certs/intermediate1-ca-cert.pem @@ -0,0 +1,184 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL intermediate CA 1, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:de:b4:c8:5c:77:e0:2d:b1:f5:b9:ad:16:47:35: + a0:35:65:65:c6:e1:40:ab:1e:b4:b9:13:b7:cb:8c: + bb:77:a5:76:da:6d:87:87:f6:4a:4d:13:e4:26:3e: + 27:87:ee:5b:c7:6a:3f:45:30:61:55:5c:f6:35:d1: + 65:fa:98:11:a3:a7:55:d5:be:91:82:4b:fc:be:90: + d6:50:53:63:9a:2c:22:e1:35:11:dc:78:02:97:8a: + e4:46:92:9c:53:08:76:de:1f:53:b6:b8:ca:77:3e: + 79:6e:bc:d0:e3:0d:30:5b:4c:f6:94:0d:30:29:64: + 9f:04:e5:db:fb:89:60:67:bb:af:26:83:51:77:24: + 2f:2b:0b:a1:94:81:10:98:e8:eb:26:a8:1e:7c:e4: + c4:6c:67:06:95:55:4a:dd:52:f4:f2:60:6d:01:2b: + 19:91:35:6d:a4:08:47:06:71:24:00:d9:de:c6:56: + f3:8b:53:2c:e2:9a:96:a5:f3:62:e5:c4:e3:23:f2: + d2:fc:21:ea:0f:62:76:8d:d5:99:48:ce:dc:58:c4: + bb:7f:da:94:2c:80:74:83:c5:e0:b0:15:7e:41:fd: + 0e:f2:f4:f0:78:76:7b:ad:26:0d:aa:48:96:17:2f: + 21:e3:95:2b:26:37:f9:aa:80:2f:fe:de:f6:5e:bc: + 97:7f + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Subject Key Identifier: + 83:C6:3A:89:2C:81:F4:02:D7:9D:4C:E2:2A:C0:71:82:64:44:DA:0E + X509v3 Authority Key Identifier: + keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:63 + X509v3 Key Usage: + Certificate Sign, CRL Sign + Authority Information Access: + OCSP - URI:http://127.0.0.1:22220 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 75:57:f1:0c:87:8f:a2:70:3c:ce:e4:70:0e:99:6a:da:c4:80: + 94:2c:25:0c:de:0d:7b:f3:94:f1:e8:ad:6f:d0:de:9a:9d:f5: + 64:31:65:3f:18:e6:c3:f5:b5:1d:a2:be:5b:97:79:41:78:15: + 1c:b3:83:de:d0:00:ea:d2:70:43:c5:60:60:07:72:e5:76:59: + b8:0e:2f:47:c9:8d:a4:4c:f1:20:b0:40:3b:ed:e9:de:b2:46: + 10:90:1b:0f:96:16:e6:97:bc:d5:9a:93:aa:3c:e3:b3:6b:5f: + db:2c:af:2b:da:7c:36:36:aa:86:a1:65:70:c8:f1:34:d1:1f: + 10:96:71:e6:cf:69:5c:bf:0e:15:33:97:fe:40:42:be:30:48: + ad:fb:d7:0e:7b:73:dd:64:30:7e:10:81:ac:3b:0b:3c:e4:12: + 9f:31:8b:3d:f0:9b:84:dc:5b:32:33:39:de:eb:1a:17:89:d8: + 1b:00:33:2d:50:a4:1a:2c:11:a2:60:ac:c1:9a:0f:44:90:00: + cf:8d:6c:af:5b:71:23:7a:a7:4f:df:f5:3f:5c:ae:93:ca:4e: + ec:f0:1b:f4:fa:53:7d:d9:36:af:5e:4c:54:c7:3a:d5:e3:68: + ca:78:e5:1f:55:44:65:eb:00:2d:c3:c8:ba:0e:1f:47:1c:67: + 2e:a9:c1:6e +-----BEGIN CERTIFICATE----- +MIIE8DCCA9igAwIBAgIBATANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM +IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx +MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBoTELMAkGA1UEBhMCVVMxEzARBgNV +BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT +U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NMIGludGVy +bWVkaWF0ZSBDQSAxMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3rTIXHfgLbH1ua0WRzWgNWVl +xuFAqx60uRO3y4y7d6V22m2Hh/ZKTRPkJj4nh+5bx2o/RTBhVVz2NdFl+pgRo6dV +1b6Rgkv8vpDWUFNjmiwi4TUR3HgCl4rkRpKcUwh23h9TtrjKdz55brzQ4w0wW0z2 +lA0wKWSfBOXb+4lgZ7uvJoNRdyQvKwuhlIEQmOjrJqgefOTEbGcGlVVK3VL08mBt +ASsZkTVtpAhHBnEkANnexlbzi1Ms4pqWpfNi5cTjI/LS/CHqD2J2jdWZSM7cWMS7 +f9qULIB0g8XgsBV+Qf0O8vTweHZ7rSYNqkiWFy8h45UrJjf5qoAv/t72XryXfwID +AQABo4IBOTCCATUwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUg8Y6iSyB9ALXnUzi +KsBxgmRE2g4wgcQGA1UdIwSBvDCBuYAUc7AcpC+Cy89HpTjXsASCOn5yFSGhgZ2k +gZowgZcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH +DAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmlu +ZzEYMBYGA1UEAwwPd29sZlNTTCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZv +QHdvbGZzc2wuY29tggFjMAsGA1UdDwQEAwIBBjAyBggrBgEFBQcBAQQmMCQwIgYI +KwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjAwDQYJKoZIhvcNAQELBQAD +ggEBAHVX8QyHj6JwPM7kcA6ZatrEgJQsJQzeDXvzlPHorW/Q3pqd9WQxZT8Y5sP1 +tR2ivluXeUF4FRyzg97QAOrScEPFYGAHcuV2WbgOL0fJjaRM8SCwQDvt6d6yRhCQ +Gw+WFuaXvNWak6o847NrX9ssryvafDY2qoahZXDI8TTRHxCWcebPaVy/DhUzl/5A +Qr4wSK371w57c91kMH4Qgaw7CzzkEp8xiz3wm4TcWzIzOd7rGheJ2BsAMy1QpBos +EaJgrMGaD0SQAM+NbK9bcSN6p0/f9T9crpPKTuzwG/T6U33ZNq9eTFTHOtXjaMp4 +5R9VRGXrAC3DyLoOH0ccZy6pwW4= +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 99 (0x63) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc: + bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca: + 48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7: + 27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90: + ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c: + 71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b: + f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76: + b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4: + 09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6: + 06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5: + 96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93: + b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36: + 44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34: + 94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9: + 75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30: + b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f: + 90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9: + 99:81 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Subject Key Identifier: + 73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + X509v3 Authority Key Identifier: + keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:63 + X509v3 Key Usage: + Certificate Sign, CRL Sign + Authority Information Access: + OCSP - URI:http://127.0.0.1:22220 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18: + 5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7: + 55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee: + bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3: + 38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03: + df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26: + d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f: + 5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3: + 5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f: + 0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c: + 48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be: + f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0: + 04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db: + 43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45: + 94:c5:8c:bb +-----BEGIN CERTIFICATE----- +MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM +IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx +MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV +BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT +U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg +Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF +ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1 +LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva +Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb +D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z +Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB +NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB +xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG +A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx +EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD +DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j +b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW +aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b +Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru +v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+ +UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94 +wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+ +9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0 +85vN1K5FlMWMuw== +-----END CERTIFICATE----- diff --git a/ocsp/stapling/client-certs/root-ca-cert.pem b/ocsp/stapling/client-certs/root-ca-cert.pem new file mode 100644 index 00000000..060acb0c --- /dev/null +++ b/ocsp/stapling/client-certs/root-ca-cert.pem @@ -0,0 +1,92 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 99 (0x63) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc: + bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca: + 48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7: + 27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90: + ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c: + 71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b: + f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76: + b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4: + 09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6: + 06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5: + 96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93: + b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36: + 44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34: + 94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9: + 75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30: + b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f: + 90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9: + 99:81 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Subject Key Identifier: + 73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + X509v3 Authority Key Identifier: + keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:63 + X509v3 Key Usage: + Certificate Sign, CRL Sign + Authority Information Access: + OCSP - URI:http://127.0.0.1:22220 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18: + 5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7: + 55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee: + bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3: + 38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03: + df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26: + d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f: + 5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3: + 5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f: + 0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c: + 48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be: + f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0: + 04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db: + 43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45: + 94:c5:8c:bb +-----BEGIN CERTIFICATE----- +MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM +IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx +MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV +BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT +U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg +Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF +ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1 +LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva +Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb +D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z +Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB +NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB +xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG +A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx +EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD +DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j +b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW +aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b +Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru +v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+ +UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94 +wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+ +9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0 +85vN1K5FlMWMuw== +-----END CERTIFICATE----- diff --git a/ocsp/stapling/ocsp-client.c b/ocsp/stapling/ocsp-client.c new file mode 100644 index 00000000..37f8cbe7 --- /dev/null +++ b/ocsp/stapling/ocsp-client.c @@ -0,0 +1,231 @@ +/* ocsp-client.c + * + * Standalone OCSP stapling client example. + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfSSL. (formerly known as CyaSSL) + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define CA_CERT "client-certs/root-ca-cert.pem" +#define INTERMEDIATE_CA_CERT "client-certs/intermediate1-ca-cert.pem" +#define SERVER_PORT 11111 + +/* Certificate verify callback for wolfSSL */ +static int cert_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store) +{ + int err = wolfSSL_X509_STORE_CTX_get_error(store); + int depth = wolfSSL_X509_STORE_CTX_get_error_depth(store); + + printf("Client: cert_verify_cb called. preverify=%d, err=%d, depth=%d\n", preverify, err, depth); + + /* If CA not found, try manual validation using CertManager */ + /* Error codes: ASN_NO_SIGNER_E, ASN_SELF_SIGNED_E, and similar */ + /* These are typically negative values, but may depend on wolfSSL build */ + if (preverify == 0) { + int ret = 1; + if (err == ASN_NO_SIGNER_E || + err == ASN_SELF_SIGNED_E +#ifdef OPENSSL_EXTRA + || err == WOLFSSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY + || err == WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT +#endif + ) { + + WOLFSSL_BUFFER_INFO* bInfo = &store->certs[depth]; + WOLFSSL_CERT_MANAGER* cm = NULL; + DecodedCert cert; + byte certInit = 0; + + cm = wolfSSL_CertManagerNew(); + if (cm == NULL) + ret = 0; + if (ret == 1 && + wolfSSL_CertManagerLoadCA(cm, CA_CERT, NULL) != WOLFSSL_SUCCESS) + ret = 0; + /* If verifying leaf cert then we need to load the intermediate CA */ + if (ret == 1 && depth == 0 && + wolfSSL_CertManagerLoadCA(cm, INTERMEDIATE_CA_CERT, NULL) != WOLFSSL_SUCCESS) + ret = 0; + + /* Verify cert with CA */ + if (ret == 1) { + wc_InitDecodedCert(&cert, bInfo->buffer, bInfo->length, NULL); + certInit = 1; + } + if (ret == 1 && wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0) + ret = 0; + + if (certInit) + wc_FreeDecodedCert(&cert); + wolfSSL_CertManagerFree(cm); + + if (ret == 1) { + printf("Client: Manual certificate validation succeeded at depth %d\n", depth); + return 1; + } else { + printf("Client: Manual certificate validation failed at depth %d\n", depth); + return 0; + } + } else { + printf("Client: Certificate verification failed at depth %d, error %d\n", depth, err); + return 0; + } + } + return 1; +} + +static int ocsp_verify_cb(WOLFSSL* ssl, int err, unsigned char* staple, unsigned int stapleSz, unsigned int idx, void* arg) +{ + (void)arg; + if (err == 0 && staple && stapleSz > 0) { + printf("Client: OCSP staple received, size=%u\n", stapleSz); + return 0; + } + /* Manual OCSP staple verification if err != 0 */ + if (err != 0 && staple && stapleSz > 0) { + WOLFSSL_CERT_MANAGER* cm = NULL; + DecodedCert cert; + byte certInit = 0; + WOLFSSL_OCSP* ocsp; + WOLFSSL_X509_CHAIN* peerCerts; + + cm = wolfSSL_CertManagerNew(); + if (cm == NULL) + goto cleanup; + if (wolfSSL_CertManagerLoadCA(cm, CA_CERT, NULL) != WOLFSSL_SUCCESS) + goto cleanup; + if (wolfSSL_CertManagerLoadCA(cm, INTERMEDIATE_CA_CERT, NULL) != WOLFSSL_SUCCESS) + goto cleanup; + + peerCerts = wolfSSL_get_peer_chain(ssl); + if (peerCerts == NULL || wolfSSL_get_chain_count(peerCerts) <= (int)idx) + goto cleanup; + + wc_InitDecodedCert(&cert, wolfSSL_get_chain_cert(peerCerts, idx), wolfSSL_get_chain_length(peerCerts, idx), NULL); + certInit = 1; + if (wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0) + goto cleanup; + if ((ocsp = wc_NewOCSP(cm)) == NULL) + goto cleanup; + if (wc_CheckCertOcspResponse(ocsp, &cert, staple, stapleSz, NULL) != 0) + goto cleanup; + + printf("Client: Manual OCSP staple verification succeeded for idx=%u\n", idx); + err = 0; +cleanup: + wc_FreeOCSP(ocsp); + if (certInit) + wc_FreeDecodedCert(&cert); + wolfSSL_CertManagerFree(cm); + if (err == 0) + return 0; + printf("Client: Manual OCSP staple verification failed for idx=%u\n", idx); + } + printf("Client: OCSP staple verify error=%d\n", err); + return err; +} + +int main() +{ + int sockfd = -1; + struct sockaddr_in serv_addr; + WOLFSSL_CTX* ctx = NULL; + WOLFSSL* ssl = NULL; + char buf[32]; + + wolfSSL_Init(); + ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method()); + if (!ctx) { + fprintf(stderr, "wolfSSL_CTX_new (client) failed\n"); + goto cleanup; + } + // if (wolfSSL_CTX_load_verify_locations(ctx, CA_CERT, NULL) != WOLFSSL_SUCCESS) { + // fprintf(stderr, "wolfSSL_CTX_load_verify_locations failed\n"); + // goto cleanup; + // } + wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, cert_verify_cb); + if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CTX_EnableOCSPStapling failed\n"); + goto cleanup; + } + if (wolfSSL_CTX_EnableOCSPMustStaple(ctx) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CTX_EnableOCSPMustStaple failed\n"); + goto cleanup; + } + if (wolfSSL_CTX_UseOCSPStaplingV2(ctx, WOLFSSL_CSR2_OCSP_MULTI, WOLFSSL_CSR2_OCSP_USE_NONCE) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CTX_UseOCSPStaplingV2 failed\n"); + goto cleanup; + } + wolfSSL_CTX_set_tls12_ocsp_status_verify_cb(ctx, ocsp_verify_cb, NULL); + + sockfd = socket(AF_INET, SOCK_STREAM, 0); + if (sockfd < 0) { + perror("socket"); + goto cleanup; + } + memset(&serv_addr, 0, sizeof(serv_addr)); + serv_addr.sin_family = AF_INET; + serv_addr.sin_port = htons(SERVER_PORT); + if (inet_pton(AF_INET, "127.0.0.1", &serv_addr.sin_addr) != 1) { + fprintf(stderr, "inet_pton failed for client\n"); + goto cleanup; + } + + if (connect(sockfd, (struct sockaddr*)&serv_addr, sizeof(serv_addr)) < 0) { + perror("connect"); + goto cleanup; + } + ssl = wolfSSL_new(ctx); + if (!ssl) { + fprintf(stderr, "wolfSSL_new (client) failed\n"); + goto cleanup; + } + wolfSSL_set_fd(ssl, sockfd); + + if (wolfSSL_connect(ssl) == WOLFSSL_SUCCESS) { + printf("Client: TLS handshake success\n"); + int n = wolfSSL_read(ssl, buf, sizeof(buf)-1); + if (n > 0) { + buf[n] = 0; + printf("Client: received: %s\n", buf); + } else if (n < 0) { + fprintf(stderr, "Client: wolfSSL_read failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + } + } else { + fprintf(stderr, "Client: TLS handshake failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + } + +cleanup: + if (ssl) wolfSSL_free(ssl); + if (sockfd >= 0) close(sockfd); + if (ctx) wolfSSL_CTX_free(ctx); + wolfSSL_Cleanup(); + return 0; +} diff --git a/ocsp/stapling/ocsp-server.c b/ocsp/stapling/ocsp-server.c new file mode 100644 index 00000000..83514698 --- /dev/null +++ b/ocsp/stapling/ocsp-server.c @@ -0,0 +1,390 @@ +/* ocsp-server.c + * + * Standalone OCSP stapling server example. + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfSSL. (formerly known as CyaSSL) + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define SERVER_CERT "server-certs/server1-cert.pem" +#define SERVER_KEY "server-certs/server1-key.pem" +#define SERVER_ISSUER_CERT "client-certs/intermediate1-ca-cert.pem" +#define SERVER_PORT 11111 + +static unsigned char* ocsp_resp = NULL; +static int ocsp_resp_sz = 0; + +static int cert_cb(WOLFSSL* ssl, void* arg) +{ + (void)arg; + if (wolfSSL_use_certificate_file(ssl, SERVER_CERT, WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) { + fprintf(stderr, "Error loading server certificate: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + return 0; + } + if (wolfSSL_use_PrivateKey_file(ssl, SERVER_KEY, WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) { + fprintf(stderr, "Error loading server private key: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + return 0; + } + return 1; +} + +int ocsp_cb(void* ctx, const char* url, int urlSz, + byte* ocspReqBuf, int ocspReqSz, byte** ocspRespBuf) +{ + (void)ctx; + if (url == NULL || urlSz <= 0 ||ocspReqBuf == NULL || ocspReqSz <= 0 || + ocspRespBuf == NULL) { + fprintf(stderr, "ocsp_cb: invalid input\n"); + return -1; + } + + // Only support http:// + const char* prefix = "http://"; + size_t prefix_len = strlen(prefix); + if (urlSz <= (int)prefix_len || strncmp(url, prefix, prefix_len) != 0) { + fprintf(stderr, "ocsp_cb: only http:// URLs are supported\n"); + return -1; + } + + // Find domain and port + const char* host_start = url + prefix_len; + const char* url_end = url + urlSz; + const char* colon = memchr(host_start, ':', url_end - host_start); + if (!colon) { + fprintf(stderr, "ocsp_cb: URL missing port\n"); + return -1; + } + const char* slash = memchr(colon, '/', url_end - colon); + size_t domain_len = colon - host_start; + size_t port_len = (slash ? (size_t)(slash - colon - 1) : (size_t)(url_end - colon - 1)); + + if (domain_len == 0 || port_len == 0) { + fprintf(stderr, "ocsp_cb: invalid domain or port in URL\n"); + return -1; + } + + char domain[256]; + char port[16]; + if (domain_len >= sizeof(domain) || port_len >= sizeof(port)) { + fprintf(stderr, "ocsp_cb: domain or port too long\n"); + return -1; + } + memcpy(domain, host_start, domain_len); + domain[domain_len] = '\0'; + memcpy(port, colon + 1, port_len); + port[port_len] = '\0'; + + // Resolve domain and port to IP address + struct addrinfo hints, *res = NULL; + memset(&hints, 0, sizeof(hints)); + hints.ai_family = AF_INET; // IPv4 + hints.ai_socktype = SOCK_STREAM; // TCP + + int gai_ret = getaddrinfo(domain, port, &hints, &res); + if (gai_ret != 0) { + fprintf(stderr, "ocsp_cb: getaddrinfo failed: %s\n", gai_strerror(gai_ret)); + return -1; + } + + // Create a socket + int sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol); + if (sock < 0) { + perror("ocsp_cb: socket"); + freeaddrinfo(res); + return -1; + } + + // Connect to the server + if (connect(sock, res->ai_addr, res->ai_addrlen) < 0) { + perror("ocsp_cb: connect"); + close(sock); + freeaddrinfo(res); + return -1; + } + + // Prepare HTTP POST header + char http_header[512]; + int header_len = snprintf( + http_header, sizeof(http_header), + "POST / HTTP/1.0\r\n" + "Host: %s\r\n" + "Content-Type: application/ocsp-request\r\n" + "Content-Length: %d\r\n" + "\r\n", + domain, ocspReqSz + ); + if (header_len < 0 || (size_t)header_len >= sizeof(http_header)) { + fprintf(stderr, "ocsp_cb: HTTP header too long\n"); + close(sock); + freeaddrinfo(res); + return -1; + } + + // Send HTTP header + if (send(sock, http_header, header_len, 0) != header_len) { + perror("ocsp_cb: send header"); + close(sock); + freeaddrinfo(res); + return -1; + } + // Send OCSP request body + if (send(sock, ocspReqBuf, ocspReqSz, 0) != ocspReqSz) { + perror("ocsp_cb: send body"); + close(sock); + freeaddrinfo(res); + return -1; + } + // Read HTTP response + char resp_buf[4096]; + int resp_len = 0; + int n; + while ((n = recv(sock, resp_buf + resp_len, sizeof(resp_buf) - resp_len, 0)) > 0) { + resp_len += n; + if (resp_len >= (int)sizeof(resp_buf)) { + fprintf(stderr, "ocsp_cb: response too large\n"); + close(sock); + freeaddrinfo(res); + return -1; + } + } + if (n < 0) { + perror("ocsp_cb: recv"); + close(sock); + freeaddrinfo(res); + return -1; + } + close(sock); + freeaddrinfo(res); + + // Find end of HTTP headers + char* body = NULL; + int body_len = 0; + char* header_end = NULL; + header_end = strstr(resp_buf, "\r\n\r\n"); + if (!header_end) { + fprintf(stderr, "ocsp_cb: malformed HTTP response\n"); + return -1; + } + body = header_end + 4; + body_len = resp_len - (body - resp_buf); + if (body_len <= 0) { + fprintf(stderr, "ocsp_cb: empty HTTP body\n"); + return -1; + } + + // Allocate and copy OCSP response body + ocsp_resp = *ocspRespBuf = (byte*)malloc(body_len); + ocsp_resp_sz = body_len; + if (!*ocspRespBuf) { + fprintf(stderr, "ocsp_cb: malloc failed\n"); + return -1; + } + memcpy(*ocspRespBuf, body, body_len); + + // Return the length of the OCSP response body + return body_len; +} + +static int fetch_ocsp_response(unsigned char** resp, int* respSz) +{ + int ret = -1; + WOLFSSL_CERT_MANAGER* cm = NULL; + unsigned char* certPem = NULL; + unsigned char* certDer = NULL; + long certPemSz = 0; + int certDerSz = 0; + FILE* f = NULL; + + *resp = NULL; + *respSz = 0; + + f = fopen(SERVER_CERT, "rb"); + if (!f) { + fprintf(stderr, "Failed to open server cert: %s\n", SERVER_CERT); + goto cleanup; + } + fseek(f, 0, SEEK_END); + certPemSz = ftell(f); + fseek(f, 0, SEEK_SET); + certPem = (unsigned char*)malloc(certPemSz); + if (!certPem) { + fprintf(stderr, "malloc failed\n"); + goto cleanup; + } + if (fread(certPem, 1, certPemSz, f) != (size_t)certPemSz) { + fprintf(stderr, "fread failed\n"); + goto cleanup; + } + + certDer = (unsigned char*)malloc(certPemSz); + if (!certDer) { + fprintf(stderr, "malloc failed\n"); + goto cleanup; + } + certDerSz = wolfSSL_CertPemToDer(certPem, (int)certPemSz, certDer, (int)certPemSz, CERT_TYPE); + if (certDerSz <= 0) { + fprintf(stderr, "wolfSSL_CertPemToDer failed\n"); + goto cleanup; + } + + cm = wolfSSL_CertManagerNew(); + if (!cm) { + fprintf(stderr, "wolfSSL_CertManagerNew failed\n"); + goto cleanup; + } + if (wolfSSL_CertManagerEnableOCSP(cm, WOLFSSL_OCSP_NO_NONCE) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CertManagerEnableOCSP failed\n"); + goto cleanup; + } + if (wolfSSL_CertManagerLoadCA(cm, SERVER_ISSUER_CERT, NULL) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CertManagerLoadCA failed for issuer cert: %s\n", SERVER_ISSUER_CERT); + goto cleanup; + } + wolfSSL_CertManagerSetOCSP_Cb(cm, ocsp_cb, NULL, NULL); + + /* Note: This does not return the raw OCSP response, just verifies. */ + if (wolfSSL_CertManagerCheckOCSP(cm, certDer, certDerSz) == WOLFSSL_SUCCESS) { + /* For real stapling, you would fetch and set the actual OCSP response here. */ + ret = 0; + } else { + fprintf(stderr, "wolfSSL_CertManagerCheckOCSP failed or OCSP not verified\n"); + } + +cleanup: + if (f) fclose(f); + if (certPem) free(certPem); + if (certDer) free(certDer); + if (cm) wolfSSL_CertManagerFree(cm); + return ret; +} + +static int status_cb(WOLFSSL* ssl, void* ctx) +{ + unsigned char* resp_buf; + + (void)ctx; + if (ocsp_resp == NULL || ocsp_resp_sz == 0) + return WOLFSSL_OCSP_STATUS_CB_ALERT_FATAL; + + resp_buf = (unsigned char*)malloc(ocsp_resp_sz); + if (resp_buf == NULL) + return WOLFSSL_OCSP_STATUS_CB_ALERT_FATAL; + + memcpy(resp_buf, ocsp_resp, ocsp_resp_sz); + if (wolfSSL_set_tlsext_status_ocsp_resp(ssl, resp_buf, ocsp_resp_sz) != WOLFSSL_SUCCESS) { + free(resp_buf); + return WOLFSSL_OCSP_STATUS_CB_ALERT_FATAL; + } + + // wolfSSL takes ownership of resp_buf, so do not free it here + return WOLFSSL_OCSP_STATUS_CB_OK; +} + +int main() +{ + int listenfd = -1, connfd = -1; + struct sockaddr_in serv_addr; + WOLFSSL_CTX* ctx = NULL; + WOLFSSL* ssl = NULL; + + if (fetch_ocsp_response(&ocsp_resp, &ocsp_resp_sz) != 0) { + fprintf(stderr, "Failed to fetch OCSP response at startup\n"); + goto cleanup; + } + + wolfSSL_Init(); + ctx = wolfSSL_CTX_new(wolfTLSv1_2_server_method()); + if (!ctx) { + fprintf(stderr, "wolfSSL_CTX_new failed\n"); + goto cleanup; + } + wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); + wolfSSL_CTX_set_cert_cb(ctx, cert_cb, NULL); + + if (wolfSSL_CTX_set_tlsext_status_cb(ctx, status_cb) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CTX_set_tlsext_status_cb failed\n"); + goto cleanup; + } + if (wolfSSL_CTX_set_tlsext_status_arg(ctx, NULL) <= 0) { + fprintf(stderr, "wolfSSL_CTX_set_tlsext_status_arg failed\n"); + goto cleanup; + } + if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CTX_EnableOCSPStapling failed\n"); + goto cleanup; + } + + listenfd = socket(AF_INET, SOCK_STREAM, 0); + if (listenfd < 0) { + perror("socket"); + goto cleanup; + } + memset(&serv_addr, 0, sizeof(serv_addr)); + serv_addr.sin_family = AF_INET; + serv_addr.sin_addr.s_addr = INADDR_ANY; + serv_addr.sin_port = htons(SERVER_PORT); + if (bind(listenfd, (struct sockaddr*)&serv_addr, sizeof(serv_addr)) < 0) { + perror("bind"); + goto cleanup; + } + if (listen(listenfd, 1) < 0) { + perror("listen"); + goto cleanup; + } + + printf("Server: waiting for connection...\n"); + connfd = accept(listenfd, NULL, NULL); + if (connfd < 0) { + perror("accept"); + goto cleanup; + } + ssl = wolfSSL_new(ctx); + if (!ssl) { + fprintf(stderr, "wolfSSL_new failed\n"); + goto cleanup; + } + wolfSSL_set_fd(ssl, connfd); + + if (wolfSSL_accept(ssl) == WOLFSSL_SUCCESS) { + printf("Server: TLS handshake success\n"); + if (wolfSSL_write(ssl, "hello", 5) != 5) { + fprintf(stderr, "Server: wolfSSL_write failed\n"); + } + } else { + fprintf(stderr, "Server: TLS handshake failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + } + +cleanup: + if (ssl) wolfSSL_free(ssl); + if (connfd >= 0) close(connfd); + if (listenfd >= 0) close(listenfd); + if (ctx) wolfSSL_CTX_free(ctx); + wolfSSL_Cleanup(); + return 0; +} diff --git a/ocsp/stapling/responder-certs/index.txt b/ocsp/stapling/responder-certs/index.txt new file mode 100644 index 00000000..b5ef6ab0 --- /dev/null +++ b/ocsp/stapling/responder-certs/index.txt @@ -0,0 +1 @@ +V 161213070133Z 05 unknown /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=www1.wolfssl.com/emailAddress=info@wolfssl.com diff --git a/ocsp/stapling/responder-certs/ocsp-responder-cert.pem b/ocsp/stapling/responder-certs/ocsp-responder-cert.pem new file mode 100644 index 00000000..5071c26f --- /dev/null +++ b/ocsp/stapling/responder-certs/ocsp-responder-cert.pem @@ -0,0 +1,181 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 4 (0x4) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL OCSP Responder, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:b8:ba:23:b4:f6:c3:7b:14:c3:a4:f5:1d:61:a1: + f5:1e:63:b9:85:23:34:50:6d:f8:7c:a2:8a:04:8b: + d5:75:5c:2d:f7:63:88:d1:07:7a:ea:0b:45:35:2b: + eb:1f:b1:22:b4:94:41:38:e2:9d:74:d6:8b:30:22: + 10:51:c5:db:ca:3f:46:2b:fe:e5:5a:3f:41:74:67: + 75:95:a9:94:d5:c3:ee:42:f8:8d:eb:92:95:e1:d9: + 65:b7:43:c4:18:de:16:80:90:ce:24:35:21:c4:55: + ac:5a:51:e0:2e:2d:b3:0a:5a:4f:4a:73:31:50:ee: + 4a:16:bd:39:8b:ad:05:48:87:b1:99:e2:10:a7:06: + 72:67:ca:5c:d1:97:bd:c8:f1:76:f8:e0:4a:ec:bc: + 93:f4:66:4c:28:71:d1:d8:66:03:b4:90:30:bb:17: + b0:fe:97:f5:1e:e8:c7:5d:9b:8b:11:19:12:3c:ab: + 82:71:78:ff:ae:3f:32:b2:08:71:b2:1b:8c:27:ac: + 11:b8:d8:43:49:cf:b0:70:b1:f0:8c:ae:da:24:87: + 17:3b:d8:04:65:6c:00:76:50:ef:15:08:d7:b4:73: + 68:26:14:87:95:c3:5f:6e:61:b8:87:84:fa:80:1a: + 0a:8b:98:f3:e3:ff:4e:44:1c:65:74:7c:71:54:65: + e5:39 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:FALSE + X509v3 Subject Key Identifier: + 32:67:E1:B1:79:D2:81:FC:9F:23:0C:70:40:50:B5:46:56:B8:30:36 + X509v3 Authority Key Identifier: + keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:63 + X509v3 Extended Key Usage: + OCSP Signing + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 4d:a2:d8:55:e0:2b:f4:ad:65:e2:92:35:cb:60:a0:a2:6b:a6: + 88:c1:86:58:57:37:bd:2e:28:6e:1c:56:2a:35:de:ff:3e:8e: + 3d:47:21:1a:e9:d3:c6:b4:e2:cb:3e:c6:af:9b:ef:23:88:56: + 95:73:2e:b3:ed:c5:11:4b:69:f7:13:3a:05:e1:af:ba:c9:59: + fd:e2:a0:81:a0:4c:0c:2c:cb:57:ad:96:3a:8c:32:a6:4a:f8: + 72:b8:ec:b3:26:69:d6:6a:4c:4c:78:18:3c:ca:19:f1:b5:8e: + 23:81:5b:27:90:e0:5c:2b:17:4d:78:99:6b:25:bd:2f:ae:1b: + aa:ce:84:b9:44:21:46:c0:34:6b:5b:b9:1b:ca:5c:60:f1:ef: + e6:66:bc:84:63:56:50:7d:bb:2c:2f:7b:47:b4:fd:58:77:87: + ee:27:20:96:72:8e:4c:7e:4f:93:eb:5f:8f:9c:1e:59:7a:96: + aa:53:77:22:41:d8:d3:f9:89:8f:e8:9d:65:bd:0c:71:3c:bb: + a3:07:bf:fb:a8:d1:18:0a:b4:c4:f7:83:b3:86:2b:f0:5b:05: + 28:c1:01:31:73:5c:2b:bd:60:97:a3:36:82:96:d7:83:df:75: + ee:29:42:97:86:41:55:b9:70:87:d5:02:85:13:41:f8:25:05: + ab:6a:aa:57 +-----BEGIN CERTIFICATE----- +MIIEvjCCA6agAwIBAgIBBDANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM +IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx +MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBnjELMAkGA1UEBhMCVVMxEzARBgNV +BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT +U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMR8wHQYDVQQDDBZ3b2xmU1NMIE9DU1Ag +UmVzcG9uZGVyMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuLojtPbDexTDpPUdYaH1HmO5hSM0 +UG34fKKKBIvVdVwt92OI0Qd66gtFNSvrH7EitJRBOOKddNaLMCIQUcXbyj9GK/7l +Wj9BdGd1lamU1cPuQviN65KV4dllt0PEGN4WgJDOJDUhxFWsWlHgLi2zClpPSnMx +UO5KFr05i60FSIexmeIQpwZyZ8pc0Ze9yPF2+OBK7LyT9GZMKHHR2GYDtJAwuxew +/pf1HujHXZuLERkSPKuCcXj/rj8ysghxshuMJ6wRuNhDSc+wcLHwjK7aJIcXO9gE +ZWwAdlDvFQjXtHNoJhSHlcNfbmG4h4T6gBoKi5jz4/9ORBxldHxxVGXlOQIDAQAB +o4IBCjCCAQYwCQYDVR0TBAIwADAdBgNVHQ4EFgQUMmfhsXnSgfyfIwxwQFC1Rla4 +MDYwgcQGA1UdIwSBvDCBuYAUc7AcpC+Cy89HpTjXsASCOn5yFSGhgZ2kgZowgZcx +CzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0 +dGxlMRAwDgYDVQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEYMBYG +A1UEAwwPd29sZlNTTCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZz +c2wuY29tggFjMBMGA1UdJQQMMAoGCCsGAQUFBwMJMA0GCSqGSIb3DQEBCwUAA4IB +AQBNothV4Cv0rWXikjXLYKCia6aIwYZYVze9LihuHFYqNd7/Po49RyEa6dPGtOLL +Psavm+8jiFaVcy6z7cURS2n3EzoF4a+6yVn94qCBoEwMLMtXrZY6jDKmSvhyuOyz +JmnWakxMeBg8yhnxtY4jgVsnkOBcKxdNeJlrJb0vrhuqzoS5RCFGwDRrW7kbylxg +8e/mZryEY1ZQfbssL3tHtP1Yd4fuJyCWco5Mfk+T61+PnB5ZepaqU3ciQdjT+YmP +6J1lvQxxPLujB7/7qNEYCrTE94OzhivwWwUowQExc1wrvWCXozaClteD33XuKUKX +hkFVuXCH1QKFE0H4JQWraqpX +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 99 (0x63) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc: + bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca: + 48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7: + 27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90: + ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c: + 71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b: + f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76: + b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4: + 09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6: + 06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5: + 96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93: + b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36: + 44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34: + 94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9: + 75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30: + b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f: + 90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9: + 99:81 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Subject Key Identifier: + 73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + X509v3 Authority Key Identifier: + keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:63 + X509v3 Key Usage: + Certificate Sign, CRL Sign + Authority Information Access: + OCSP - URI:http://127.0.0.1:22220 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18: + 5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7: + 55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee: + bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3: + 38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03: + df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26: + d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f: + 5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3: + 5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f: + 0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c: + 48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be: + f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0: + 04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db: + 43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45: + 94:c5:8c:bb +-----BEGIN CERTIFICATE----- +MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM +IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx +MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV +BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT +U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg +Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF +ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1 +LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva +Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb +D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z +Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB +NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB +xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG +A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx +EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD +DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j +b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW +aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b +Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru +v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+ +UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94 +wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+ +9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0 +85vN1K5FlMWMuw== +-----END CERTIFICATE----- diff --git a/ocsp/stapling/responder-certs/ocsp-responder-key.pem b/ocsp/stapling/responder-certs/ocsp-responder-key.pem new file mode 100644 index 00000000..61c5616a --- /dev/null +++ b/ocsp/stapling/responder-certs/ocsp-responder-key.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAuLojtPbDexTDpPUdYaH1HmO5hSM0UG34fKKKBIvVdVwt92OI +0Qd66gtFNSvrH7EitJRBOOKddNaLMCIQUcXbyj9GK/7lWj9BdGd1lamU1cPuQviN +65KV4dllt0PEGN4WgJDOJDUhxFWsWlHgLi2zClpPSnMxUO5KFr05i60FSIexmeIQ +pwZyZ8pc0Ze9yPF2+OBK7LyT9GZMKHHR2GYDtJAwuxew/pf1HujHXZuLERkSPKuC +cXj/rj8ysghxshuMJ6wRuNhDSc+wcLHwjK7aJIcXO9gEZWwAdlDvFQjXtHNoJhSH +lcNfbmG4h4T6gBoKi5jz4/9ORBxldHxxVGXlOQIDAQABAoIBAGI2tR1VxYD+/TYL +DGAIV+acZtqeaQYKMf8x++eG4SrQo6/QP8HDFFqzO0yV2SC0cRtJZ5PzCHxCRSaG +Nd8EL2NMWOazUwW0c/yLtTypOPSeg2Mf+3SwLvgxOZ9CbFQ8YAJi+vbNOPLGCijL +N0HWEkcC1P1kWWgKCWIloR7eEt0IQOb5PPSCu3buq/rForb6qUf+L+ESpWed6bnc +uhIrHDuQ/PopW05fW1r61zI286wKdLRyatQsljNqPvVdFVhtCKqCqMHdIzMg2cbh +q9DJMWc/KLjzBk6YPMZKm/4k4RXj+IwS+iITbpUNrhYj2TMevBMPW3AIRobD823D +ehQv+rECgYEA3CWL+G9zJ5PXRDAdQ69lN+CE/Uf9444CN5idMO+qRQ+QE8hWYT/U +PFH/aUgd1k3WJZseR/GTWx29VsRPSDWZXzwzLfUNKnqvp0b2oZe/EdYiRSo8OCPp +kF07HbTKe4Cyma7HdgDkNkS+UW5JujnuLcuee+wTq6xU0289juwFBc8CgYEA1s/d +VtwXqBf3qMxfi+eMa77fqxptAFGtZNKNkYwX42Ow6Hehj8EnoPqYEF+9MzKn/BFh +ROnQ76axKBN8mkRUjpv7d2+zMlDnGrWul8q6VrfGiU2P7jd4L6GY/V1MYktnIBsd +Ld/jW8P0FFfI2RIREPWdrATxBhQpTJfXd/7rLncCgYB1wrvyBCQUSrg/KIGvADbj +wf1Bw23jeMZk2QVU9Q8e7ClE+8iBMvSj47T9q28SgQaJjUWQdIA/oFP1AwPp+4n0 +cK5r6gbF72Tg1Uv+ur6hmuswFlyqJ0O8TrLdvCUIFZr0LJNT4zwwb2tjAdz8ehqX +crFvVqRbE884XuwN9ODm7wKBgQDIEnKlI/kkpq4UmcWkGNXAxNauFr7PPUOyVCln +FoRpVcC/xCzGJ7ExTjWzing950BulgFynhPsIeV+3id/x4S6Dq34YCEXDCMzzWQA +HOHRQvm3iHY1+ZQHSQulb/Bk3LYAQUC8KXspTSlYiSqYgytCEIH6Zd/XOY/9tq8J +JHUHoQKBgHYIB2mRCuDK5C3dCspdPVeAUqptK1nnXxWY/MXA6v+M4wFsIxV7Iwg7 +HEjeD5yKH4619syPCFz3jrCxL0oJqVTD2tnrbLf8idEt2eaV/3o2mUGFjvWpTywg +F8DewhrGh6z7FWHp4cMrxpq1hkdi6k+481T1GKBJ1zBSTzskTHQB +-----END RSA PRIVATE KEY----- diff --git a/ocsp/stapling/server-certs/server1-cert.pem b/ocsp/stapling/server-certs/server1-cert.pem new file mode 100644 index 00000000..dfc0c738 --- /dev/null +++ b/ocsp/stapling/server-certs/server1-cert.pem @@ -0,0 +1,276 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 5 (0x5) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL intermediate CA 1, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = www1.wolfssl.com, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:e6:96:55:75:cf:8a:97:68:8c:b6:38:f6:7a:05: + be:33:b6:51:47:37:8a:f7:db:91:be:92:6b:b7:00: + 8c:f2:c5:24:6e:18:e9:92:00:81:01:dc:b3:4c:28: + a9:b7:80:f1:96:cf:23:7a:2f:ae:f8:e3:0f:2d:d3: + 5e:23:e7:db:4c:b2:5d:89:16:17:be:be:81:db:fb: + 12:6d:28:4b:10:a0:12:04:27:c1:c9:d0:79:95:ef: + e8:8d:8c:59:9b:4e:72:7d:bc:49:2b:22:4e:f8:4f: + e2:0c:f1:e9:e9:97:f9:df:8c:5a:0a:aa:38:1d:43: + 04:a3:a7:89:a1:e2:83:a4:4b:b5:4e:45:88:a6:22: + 5d:ac:a9:58:67:88:c1:d5:61:ef:bd:11:05:27:94: + 47:bb:33:a5:8a:ca:ee:1f:8d:c0:6e:24:af:cd:ca: + bf:80:47:71:95:ac:a9:f1:5d:23:6c:f5:4b:b4:a9: + e1:c4:66:fb:e5:c4:a1:9f:a7:51:d1:78:cd:2e:b4: + 3f:2e:e2:82:f3:7f:c4:a7:f4:31:cf:76:27:3f:db: + 2e:d2:6e:c3:47:23:82:a3:48:40:8c:a7:c1:13:f0: + 63:50:54:43:f6:71:12:e1:6f:a5:7a:58:26:f7:fd: + 8b:3b:70:18:a0:43:ba:01:6b:b3:f8:d5:be:05:13: + 64:31 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:FALSE + X509v3 Subject Key Identifier: + CC:55:15:00:E2:44:89:92:63:6D:10:5D:B9:9E:73:B6:5D:3A:19:CA + X509v3 Authority Key Identifier: + keyid:83:C6:3A:89:2C:81:F4:02:D7:9D:4C:E2:2A:C0:71:82:64:44:DA:0E + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:01 + X509v3 Key Usage: + Digital Signature, Non Repudiation, Key Encipherment + Authority Information Access: + OCSP - URI:http://127.0.0.1:22221 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 7c:53:b6:71:1e:1a:9a:54:42:15:3a:81:06:d2:7c:bc:56:63: + 13:0a:4d:21:3f:59:68:4c:07:17:65:a1:26:ce:10:4c:90:f5: + 13:66:60:9b:9c:d9:85:7f:a3:da:9f:a6:d7:69:df:c7:b1:0b: + 4d:14:93:32:7f:df:7a:e6:ab:cc:74:de:a8:6d:c5:4c:55:be: + a1:8a:14:48:38:e0:34:76:5c:cb:27:6b:a1:31:de:6c:bc:ac: + ea:73:7e:ce:ad:86:e2:54:7b:0f:87:4f:b7:24:c0:06:83:17: + 0d:75:a7:09:5e:2f:74:c3:85:f5:2e:ec:84:21:b6:ce:93:0d: + bf:5c:39:24:5d:e0:63:25:04:5c:23:a7:d8:93:e8:1a:34:44: + fb:67:94:80:45:7c:78:31:20:d1:ed:a2:06:6b:84:1f:3a:99: + f2:de:14:cb:8e:cf:fd:dd:51:a3:af:17:8a:83:f3:f5:4e:ea: + a5:33:c8:fa:84:9a:17:7e:5d:6f:f8:90:2e:ac:88:66:b6:49: + 44:72:85:43:ca:58:d9:94:56:85:98:56:b8:34:d4:22:5d:8e: + 7a:35:ef:5a:96:15:29:2d:7b:f1:1f:55:98:7f:2f:d8:08:36: + ec:c9:a1:c6:05:3e:db:dd:e4:f8:2d:ca:92:e0:e8:a4:e4:7c: + 39:77:72:97 +-----BEGIN CERTIFICATE----- +MIIE7jCCA9agAwIBAgIBBTANBgkqhkiG9w0BAQsFADCBoTELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NM +IGludGVybWVkaWF0ZSBDQSAxMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wu +Y29tMB4XDTI0MTIxODIxMjUzMVoXDTI3MDkxNDIxMjUzMVowgZgxCzAJBgNVBAYT +AlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYD +VQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEZMBcGA1UEAwwQd3d3 +MS53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTCC +ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOaWVXXPipdojLY49noFvjO2 +UUc3ivfbkb6Sa7cAjPLFJG4Y6ZIAgQHcs0woqbeA8ZbPI3ovrvjjDy3TXiPn20yy +XYkWF76+gdv7Em0oSxCgEgQnwcnQeZXv6I2MWZtOcn28SSsiTvhP4gzx6emX+d+M +WgqqOB1DBKOniaHig6RLtU5FiKYiXaypWGeIwdVh770RBSeUR7szpYrK7h+NwG4k +r83Kv4BHcZWsqfFdI2z1S7Sp4cRm++XEoZ+nUdF4zS60Py7igvN/xKf0Mc92Jz/b +LtJuw0cjgqNIQIynwRPwY1BUQ/ZxEuFvpXpYJvf9iztwGKBDugFrs/jVvgUTZDEC +AwEAAaOCATYwggEyMAkGA1UdEwQCMAAwHQYDVR0OBBYEFMxVFQDiRImSY20QXbme +c7ZdOhnKMIHEBgNVHSMEgbwwgbmAFIPGOoksgfQC151M4irAcYJkRNoOoYGdpIGa +MIGXMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwH +U2VhdHRsZTEQMA4GA1UECgwHd29sZlNTTDEUMBIGA1UECwwLRW5naW5lZXJpbmcx +GDAWBgNVBAMMD3dvbGZTU0wgcm9vdCBDQTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3 +b2xmc3NsLmNvbYIBATALBgNVHQ8EBAMCBeAwMgYIKwYBBQUHAQEEJjAkMCIGCCsG +AQUFBzABhhZodHRwOi8vMTI3LjAuMC4xOjIyMjIxMA0GCSqGSIb3DQEBCwUAA4IB +AQB8U7ZxHhqaVEIVOoEG0ny8VmMTCk0hP1loTAcXZaEmzhBMkPUTZmCbnNmFf6Pa +n6bXad/HsQtNFJMyf9965qvMdN6obcVMVb6hihRIOOA0dlzLJ2uhMd5svKzqc37O +rYbiVHsPh0+3JMAGgxcNdacJXi90w4X1LuyEIbbOkw2/XDkkXeBjJQRcI6fYk+ga +NET7Z5SARXx4MSDR7aIGa4QfOpny3hTLjs/93VGjrxeKg/P1TuqlM8j6hJoXfl1v ++JAurIhmtklEcoVDyljZlFaFmFa4NNQiXY56Ne9alhUpLXvxH1WYfy/YCDbsyaHG +BT7b3eT4LcqS4Oik5Hw5d3KX +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL intermediate CA 1, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:de:b4:c8:5c:77:e0:2d:b1:f5:b9:ad:16:47:35: + a0:35:65:65:c6:e1:40:ab:1e:b4:b9:13:b7:cb:8c: + bb:77:a5:76:da:6d:87:87:f6:4a:4d:13:e4:26:3e: + 27:87:ee:5b:c7:6a:3f:45:30:61:55:5c:f6:35:d1: + 65:fa:98:11:a3:a7:55:d5:be:91:82:4b:fc:be:90: + d6:50:53:63:9a:2c:22:e1:35:11:dc:78:02:97:8a: + e4:46:92:9c:53:08:76:de:1f:53:b6:b8:ca:77:3e: + 79:6e:bc:d0:e3:0d:30:5b:4c:f6:94:0d:30:29:64: + 9f:04:e5:db:fb:89:60:67:bb:af:26:83:51:77:24: + 2f:2b:0b:a1:94:81:10:98:e8:eb:26:a8:1e:7c:e4: + c4:6c:67:06:95:55:4a:dd:52:f4:f2:60:6d:01:2b: + 19:91:35:6d:a4:08:47:06:71:24:00:d9:de:c6:56: + f3:8b:53:2c:e2:9a:96:a5:f3:62:e5:c4:e3:23:f2: + d2:fc:21:ea:0f:62:76:8d:d5:99:48:ce:dc:58:c4: + bb:7f:da:94:2c:80:74:83:c5:e0:b0:15:7e:41:fd: + 0e:f2:f4:f0:78:76:7b:ad:26:0d:aa:48:96:17:2f: + 21:e3:95:2b:26:37:f9:aa:80:2f:fe:de:f6:5e:bc: + 97:7f + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Subject Key Identifier: + 83:C6:3A:89:2C:81:F4:02:D7:9D:4C:E2:2A:C0:71:82:64:44:DA:0E + X509v3 Authority Key Identifier: + keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:63 + X509v3 Key Usage: + Certificate Sign, CRL Sign + Authority Information Access: + OCSP - URI:http://127.0.0.1:22220 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 75:57:f1:0c:87:8f:a2:70:3c:ce:e4:70:0e:99:6a:da:c4:80: + 94:2c:25:0c:de:0d:7b:f3:94:f1:e8:ad:6f:d0:de:9a:9d:f5: + 64:31:65:3f:18:e6:c3:f5:b5:1d:a2:be:5b:97:79:41:78:15: + 1c:b3:83:de:d0:00:ea:d2:70:43:c5:60:60:07:72:e5:76:59: + b8:0e:2f:47:c9:8d:a4:4c:f1:20:b0:40:3b:ed:e9:de:b2:46: + 10:90:1b:0f:96:16:e6:97:bc:d5:9a:93:aa:3c:e3:b3:6b:5f: + db:2c:af:2b:da:7c:36:36:aa:86:a1:65:70:c8:f1:34:d1:1f: + 10:96:71:e6:cf:69:5c:bf:0e:15:33:97:fe:40:42:be:30:48: + ad:fb:d7:0e:7b:73:dd:64:30:7e:10:81:ac:3b:0b:3c:e4:12: + 9f:31:8b:3d:f0:9b:84:dc:5b:32:33:39:de:eb:1a:17:89:d8: + 1b:00:33:2d:50:a4:1a:2c:11:a2:60:ac:c1:9a:0f:44:90:00: + cf:8d:6c:af:5b:71:23:7a:a7:4f:df:f5:3f:5c:ae:93:ca:4e: + ec:f0:1b:f4:fa:53:7d:d9:36:af:5e:4c:54:c7:3a:d5:e3:68: + ca:78:e5:1f:55:44:65:eb:00:2d:c3:c8:ba:0e:1f:47:1c:67: + 2e:a9:c1:6e +-----BEGIN CERTIFICATE----- +MIIE8DCCA9igAwIBAgIBATANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM +IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx +MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBoTELMAkGA1UEBhMCVVMxEzARBgNV +BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT +U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMSIwIAYDVQQDDBl3b2xmU1NMIGludGVy +bWVkaWF0ZSBDQSAxMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3rTIXHfgLbH1ua0WRzWgNWVl +xuFAqx60uRO3y4y7d6V22m2Hh/ZKTRPkJj4nh+5bx2o/RTBhVVz2NdFl+pgRo6dV +1b6Rgkv8vpDWUFNjmiwi4TUR3HgCl4rkRpKcUwh23h9TtrjKdz55brzQ4w0wW0z2 +lA0wKWSfBOXb+4lgZ7uvJoNRdyQvKwuhlIEQmOjrJqgefOTEbGcGlVVK3VL08mBt +ASsZkTVtpAhHBnEkANnexlbzi1Ms4pqWpfNi5cTjI/LS/CHqD2J2jdWZSM7cWMS7 +f9qULIB0g8XgsBV+Qf0O8vTweHZ7rSYNqkiWFy8h45UrJjf5qoAv/t72XryXfwID +AQABo4IBOTCCATUwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUg8Y6iSyB9ALXnUzi +KsBxgmRE2g4wgcQGA1UdIwSBvDCBuYAUc7AcpC+Cy89HpTjXsASCOn5yFSGhgZ2k +gZowgZcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH +DAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmlu +ZzEYMBYGA1UEAwwPd29sZlNTTCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZv +QHdvbGZzc2wuY29tggFjMAsGA1UdDwQEAwIBBjAyBggrBgEFBQcBAQQmMCQwIgYI +KwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MjIyMjAwDQYJKoZIhvcNAQELBQAD +ggEBAHVX8QyHj6JwPM7kcA6ZatrEgJQsJQzeDXvzlPHorW/Q3pqd9WQxZT8Y5sP1 +tR2ivluXeUF4FRyzg97QAOrScEPFYGAHcuV2WbgOL0fJjaRM8SCwQDvt6d6yRhCQ +Gw+WFuaXvNWak6o847NrX9ssryvafDY2qoahZXDI8TTRHxCWcebPaVy/DhUzl/5A +Qr4wSK371w57c91kMH4Qgaw7CzzkEp8xiz3wm4TcWzIzOd7rGheJ2BsAMy1QpBos +EaJgrMGaD0SQAM+NbK9bcSN6p0/f9T9crpPKTuzwG/T6U33ZNq9eTFTHOtXjaMp4 +5R9VRGXrAC3DyLoOH0ccZy6pwW4= +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 99 (0x63) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Validity + Not Before: Dec 18 21:25:31 2024 GMT + Not After : Sep 14 21:25:31 2027 GMT + Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:ab:2c:b4:2f:1d:06:09:ef:4e:29:86:84:7e:cc: + bf:a6:79:7c:f0:c0:c1:64:25:8c:75:b7:10:05:ca: + 48:27:0c:0e:32:1c:b0:fe:99:85:39:b6:b9:a2:f7: + 27:ff:6d:3c:8c:16:73:29:21:7f:8b:a6:54:71:90: + ad:cc:05:b9:9f:15:c7:0a:3f:5f:69:f4:0a:5f:8c: + 71:b5:2c:bf:66:e2:03:9a:32:f4:d2:ec:2a:89:4b: + f9:35:88:14:33:47:4e:2e:05:79:01:ed:64:36:76: + b9:f8:85:cd:01:88:ac:c5:b2:b1:59:b8:cd:5a:f4: + 09:09:38:9b:da:5a:cf:ce:78:99:1f:49:3d:41:d6: + 06:7c:52:99:c8:97:d1:b3:80:3a:a2:4f:36:c4:c5: + 96:30:77:31:38:c8:70:cc:e1:67:06:b3:2b:2f:93: + b5:69:cf:83:7e:88:53:9b:0f:46:21:4c:d6:05:36: + 44:99:60:68:47:e5:32:01:12:d4:10:73:ae:9a:34: + 94:fa:6e:b8:58:4f:7b:5b:8a:92:97:ad:fd:97:b9: + 75:ca:c2:d4:45:7d:17:6b:cd:2f:f3:63:7a:0e:30: + b5:0b:a9:d9:a6:7c:74:60:9d:cc:09:03:43:f1:0f: + 90:d3:b7:fe:6c:9f:d9:cd:78:4b:15:ae:8c:5b:f9: + 99:81 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:TRUE + X509v3 Subject Key Identifier: + 73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + X509v3 Authority Key Identifier: + keyid:73:B0:1C:A4:2F:82:CB:CF:47:A5:38:D7:B0:04:82:3A:7E:72:15:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com + serial:63 + X509v3 Key Usage: + Certificate Sign, CRL Sign + Authority Information Access: + OCSP - URI:http://127.0.0.1:22220 + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 76:e8:fa:f6:1e:5b:0e:ff:24:43:e0:cb:19:26:38:d9:df:18: + 5d:66:e1:4b:ac:e4:8e:b0:49:2c:d6:04:20:eb:4a:a8:06:d7: + 55:ec:6b:38:f8:0f:8c:e6:c9:ec:42:f0:ca:07:9f:88:7a:ee: + bf:af:3f:7d:d3:45:67:20:84:bb:c7:c5:32:69:ab:59:e1:e3: + 38:4b:ed:18:2e:de:da:88:ec:a0:b7:ff:c1:50:96:73:e3:03: + df:a1:e7:47:93:13:1d:fb:e6:6b:37:3e:50:a3:eb:5b:24:26: + d2:43:2e:6e:9c:83:9c:fb:79:ba:cd:fd:3b:e5:87:87:a7:0f: + 5f:f9:64:34:56:5e:8b:13:e2:c4:41:e3:9d:3e:36:2d:cb:d3: + 5f:d3:12:90:bf:78:c1:4c:df:eb:7b:99:e6:1e:ee:52:78:6f: + 0c:82:e1:59:d4:25:40:e5:24:95:3e:0f:cc:08:60:fe:b4:8c: + 48:42:bf:29:74:92:71:1a:85:00:a7:4c:f0:c0:32:47:f3:be: + f4:08:5c:f2:43:e0:b9:76:86:60:9a:3b:af:d6:32:41:5f:b0: + 04:12:44:2a:44:19:d4:27:d3:ce:71:7e:5b:16:1a:f5:0c:db: + 43:b0:a6:bb:76:02:f6:e0:30:4e:04:f4:f3:9b:cd:d4:ae:45: + 94:c5:8c:bb +-----BEGIN CERTIFICATE----- +MIIE5jCCA86gAwIBAgIBYzANBgkqhkiG9w0BAQsFADCBlzELMAkGA1UEBhMCVVMx +EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoM +B3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NM +IHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjQx +MjE4MjEyNTMxWhcNMjcwOTE0MjEyNTMxWjCBlzELMAkGA1UEBhMCVVMxEzARBgNV +BAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZT +U0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93b2xmU1NMIHJvb3Qg +Q0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQCrLLQvHQYJ704phoR+zL+meXzwwMFkJYx1txAF +ykgnDA4yHLD+mYU5trmi9yf/bTyMFnMpIX+LplRxkK3MBbmfFccKP19p9ApfjHG1 +LL9m4gOaMvTS7CqJS/k1iBQzR04uBXkB7WQ2drn4hc0BiKzFsrFZuM1a9AkJOJva +Ws/OeJkfST1B1gZ8UpnIl9GzgDqiTzbExZYwdzE4yHDM4WcGsysvk7Vpz4N+iFOb +D0YhTNYFNkSZYGhH5TIBEtQQc66aNJT6brhYT3tbipKXrf2XuXXKwtRFfRdrzS/z +Y3oOMLULqdmmfHRgncwJA0PxD5DTt/5sn9nNeEsVroxb+ZmBAgMBAAGjggE5MIIB +NTAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRzsBykL4LLz0elONewBII6fnIVITCB +xAYDVR0jBIG8MIG5gBRzsBykL4LLz0elONewBII6fnIVIaGBnaSBmjCBlzELMAkG +A1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUx +EDAOBgNVBAoMB3dvbGZTU0wxFDASBgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQD +DA93b2xmU1NMIHJvb3QgQ0ExHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5j +b22CAWMwCwYDVR0PBAQDAgEGMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYW +aHR0cDovLzEyNy4wLjAuMToyMjIyMDANBgkqhkiG9w0BAQsFAAOCAQEAduj69h5b +Dv8kQ+DLGSY42d8YXWbhS6zkjrBJLNYEIOtKqAbXVexrOPgPjObJ7ELwygefiHru +v68/fdNFZyCEu8fFMmmrWeHjOEvtGC7e2ojsoLf/wVCWc+MD36HnR5MTHfvmazc+ +UKPrWyQm0kMubpyDnPt5us39O+WHh6cPX/lkNFZeixPixEHjnT42LcvTX9MSkL94 +wUzf63uZ5h7uUnhvDILhWdQlQOUklT4PzAhg/rSMSEK/KXSScRqFAKdM8MAyR/O+ +9Ahc8kPguXaGYJo7r9YyQV+wBBJEKkQZ1CfTznF+WxYa9QzbQ7Cmu3YC9uAwTgT0 +85vN1K5FlMWMuw== +-----END CERTIFICATE----- diff --git a/ocsp/stapling/server-certs/server1-key.pem b/ocsp/stapling/server-certs/server1-key.pem new file mode 100644 index 00000000..e44f6312 --- /dev/null +++ b/ocsp/stapling/server-certs/server1-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDmllV1z4qXaIy2 +OPZ6Bb4ztlFHN4r325G+kmu3AIzyxSRuGOmSAIEB3LNMKKm3gPGWzyN6L6744w8t +014j59tMsl2JFhe+voHb+xJtKEsQoBIEJ8HJ0HmV7+iNjFmbTnJ9vEkrIk74T+IM +8enpl/nfjFoKqjgdQwSjp4mh4oOkS7VORYimIl2sqVhniMHVYe+9EQUnlEe7M6WK +yu4fjcBuJK/Nyr+AR3GVrKnxXSNs9Uu0qeHEZvvlxKGfp1HReM0utD8u4oLzf8Sn +9DHPdic/2y7SbsNHI4KjSECMp8ET8GNQVEP2cRLhb6V6WCb3/Ys7cBigQ7oBa7P4 +1b4FE2QxAgMBAAECggEBAMcAl2DFbOae5FGfd5h3vF8EycCcvuKKLI4775pQb1RV +r8sU1P+cT7o7rsHblh04u0dcHVImNOu3ijISaPyz7R+UEAVve66y23/uf0iVrbL7 +cpEDfsudkFFGa30901elrEm3Za5EPcMvrfdeEHH5Jz02876giS032ZkjzjRYOSRg +TuFhiqjRTMfE6AB63KSRWcb6AYEocHV/jF+IEQcz9ctsv6XKKKJtge4+Y3+gQU4N +ALUE6OjBsD5KpMVuMYBSfTucYi5g2eOK05PoCOR8lTqgvsbof+ALj+84zEpG20aK +p0KdMVwiMolXaYcvKBOGPxZKt7sQaIMitbs0iuErMQECgYEA+cLVZh4qkRnsjPVc +/27qC/VLeWo2QAL7TWC7YgkY0MgNtZXRkJZdKOlzYWo/iJmuxHj7eUFLkoHpPNV2 +X6WG+CGHD1qq/BqLQNlJKS/MtI2VNzOjBJ/J3SktOGo3BwL+Q5uSRNHukQip0YnD +c9GCU4UhfBHr/UNitMBH6N5aPqUCgYEA7FjjTGomVseF5wNbfw2xLjBmRuQ2DDgJ +/OvCtV6it+OiVU9R+cYcz/hVl1QLIkGBHt5hb8O6np4tW5ehKd5LNTtolIO+/BLL +2xPZCLY7U+LES5dgUTC/wb5t5igAmPuOMi9qNQ1kYxbKYJVLRUdwfOM8FNE4gjZF +kj2BIb6OxZ0CgYEAmuXXvWZ2FdmTGHTPwWdDZjkyHtHdZWO0AXA9pnZn2oxH3FdX +SinHCymFsmPXlVtixV0W8UOqn+lMAruMl5MsGtWIUuBzbLj1pjlcI1wOw+ePJFY1 +AxgqdKwl7HgLOqEDmmBwnZfpMi/CSj77ZegIwM2vT6g5yK+zFtCtiGHmbDUCgYBf +L2VLbyzFolGBOk7tGnyTF5b5UguaXC9ZlzGxjc2Gtby5Etr29xy/fUorSgO55hu0 +bOdc9b0BCL9HtgeILyim5ag2t+CA8Kj9MD8mTQ4TuK5Jq0t1J2bzBliIau/irN0V +xRbHCv+1EIas4zOPUTgyc+nMkH5roqPeQ7rv9ijV2QKBgQDJiNmAJv3dlie2x+bj +rX5RDF1Q/egVVGx41jPyuzh0oFLwEQG2lSHEAKgF+gWt0ZMwNzPB9oue2LBSpNFl +7ZdpFCpzD+3OcaxnWYEGT+qNhczbf0PvVNBOzOI33Trr7maktWi0Mh9qmXqoNuwG +uCnrEriJlBk2MV88tIG/ZJ+bvQ== +-----END PRIVATE KEY----- From 35cae80512a518cd20296e17e004c5fb70d042ce Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Fri, 19 Sep 2025 12:02:14 +0200 Subject: [PATCH 02/10] Add Eclipse to .gitignore --- .gitignore | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.gitignore b/.gitignore index 709529ce..11f55f4b 100644 --- a/.gitignore +++ b/.gitignore @@ -382,3 +382,9 @@ tpm/evp_tpm /Arduino/**/.visualgdb/* /Arduino/sketches/output.log /**/*.bak + +# Eclipse +\.settings/ +\.cproject +\.project +\.autotools From e3915943b0f4a47678cccff9db115f4ed10d1b47 Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Fri, 19 Sep 2025 14:03:49 +0200 Subject: [PATCH 03/10] Fix: Allows address reuse for OCSP server Enables the SO_REUSEADDR socket option to prevent "Address already in use" errors when restarting the OCSP server, improving its reliability and availability. --- ocsp/stapling/ocsp-server.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ocsp/stapling/ocsp-server.c b/ocsp/stapling/ocsp-server.c index 83514698..bff8b7ca 100644 --- a/ocsp/stapling/ocsp-server.c +++ b/ocsp/stapling/ocsp-server.c @@ -345,6 +345,11 @@ int main() perror("socket"); goto cleanup; } + int optval = 1; + if (setsockopt(listenfd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof(optval)) < 0) { + perror("setsockopt"); + goto cleanup; + } memset(&serv_addr, 0, sizeof(serv_addr)); serv_addr.sin_family = AF_INET; serv_addr.sin_addr.s_addr = INADDR_ANY; From d269fb5b96441c1045e5c19ff63db81d857ee5ea Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Fri, 19 Sep 2025 14:04:21 +0200 Subject: [PATCH 04/10] Adds support for verifying OCSP staples in TLS 1.3. - Implements manual OCSP staple verification for TLS 1.3 in the client. - Adds command line argument to select between TLS 1.2 and 1.3. - Updates server to use generic TLS server method. --- ocsp/stapling/ocsp-client.c | 61 +++++++++++++++++++++++++++++++------ ocsp/stapling/ocsp-server.c | 3 +- 2 files changed, 54 insertions(+), 10 deletions(-) diff --git a/ocsp/stapling/ocsp-client.c b/ocsp/stapling/ocsp-client.c index 37f8cbe7..46e5129b 100644 --- a/ocsp/stapling/ocsp-client.c +++ b/ocsp/stapling/ocsp-client.c @@ -62,6 +62,7 @@ static int cert_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store) WOLFSSL_CERT_MANAGER* cm = NULL; DecodedCert cert; byte certInit = 0; + WOLFSSL* ssl = (WOLFSSL*)store->userCtx; cm = wolfSSL_CertManagerNew(); if (cm == NULL) @@ -82,6 +83,27 @@ static int cert_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store) if (ret == 1 && wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0) ret = 0; + if (ret == 1 && (wolfSSL_version(ssl) == TLS1_3_VERSION || + wolfSSL_version(ssl) == DTLS1_3_VERSION)) { + WOLFSSL_BUFFER_INFO* ocspStaple = wolfSSL_GetTls13OcspStatusResp(ssl, (word32)depth); + WOLFSSL_OCSP* ocsp = NULL; + + if (ocspStaple == NULL || ocspStaple->buffer == NULL ||ocspStaple->length == 0) + ret = 0; + if (ret == 1 && (ocsp = wc_NewOCSP(cm)) == NULL) + ret = 0; + if (ret == 1 && + wc_CheckCertOcspResponse(ocsp, &cert, ocspStaple->buffer, + ocspStaple->length, NULL) != 0) + ret = 0; + wc_FreeOCSP(ocsp); + + if (ret == 1) + printf("Client: Manual OCSP staple verification succeeded at depth %d\n", depth); + else + printf("Client: Manual OCSP staple verification failed at depth %d\n", depth); + } + if (certInit) wc_FreeDecodedCert(&cert); wolfSSL_CertManagerFree(cm); @@ -152,24 +174,34 @@ cleanup: return err; } -int main() +int main(int argc, char** argv) { int sockfd = -1; struct sockaddr_in serv_addr; WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; char buf[32]; + int use_tls13 = 0; + + if (argc != 2) { + printf("Usage: %s [--tls12|--tls13]\n", argv[0]); + return 0; + } + if (strcmp(argv[1], "--tls13") == 0) { + use_tls13 = 1; + } else if (strcmp(argv[1], "--tls12") == 0) { + use_tls13 = 0; + } else { + printf("Usage: %s [--tls12|--tls13]\n", argv[0]); + return 0; + } wolfSSL_Init(); - ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method()); + ctx = wolfSSL_CTX_new(use_tls13 ? wolfTLSv1_3_client_method() : wolfTLSv1_2_client_method()); if (!ctx) { fprintf(stderr, "wolfSSL_CTX_new (client) failed\n"); goto cleanup; } - // if (wolfSSL_CTX_load_verify_locations(ctx, CA_CERT, NULL) != WOLFSSL_SUCCESS) { - // fprintf(stderr, "wolfSSL_CTX_load_verify_locations failed\n"); - // goto cleanup; - // } wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, cert_verify_cb); if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS) { fprintf(stderr, "wolfSSL_CTX_EnableOCSPStapling failed\n"); @@ -179,9 +211,17 @@ int main() fprintf(stderr, "wolfSSL_CTX_EnableOCSPMustStaple failed\n"); goto cleanup; } - if (wolfSSL_CTX_UseOCSPStaplingV2(ctx, WOLFSSL_CSR2_OCSP_MULTI, WOLFSSL_CSR2_OCSP_USE_NONCE) != WOLFSSL_SUCCESS) { - fprintf(stderr, "wolfSSL_CTX_UseOCSPStaplingV2 failed\n"); - goto cleanup; + if (use_tls13) { + if (wolfSSL_CTX_UseOCSPStapling(ctx, WOLFSSL_CSR_OCSP, 0) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CTX_UseOCSPStaplingV2 failed\n"); + goto cleanup; + } + } + else { + if (wolfSSL_CTX_UseOCSPStaplingV2(ctx, WOLFSSL_CSR2_OCSP_MULTI, 0) != WOLFSSL_SUCCESS) { + fprintf(stderr, "wolfSSL_CTX_UseOCSPStaplingV2 failed\n"); + goto cleanup; + } } wolfSSL_CTX_set_tls12_ocsp_status_verify_cb(ctx, ocsp_verify_cb, NULL); @@ -208,9 +248,12 @@ int main() goto cleanup; } wolfSSL_set_fd(ssl, sockfd); + /* No way to get ssl from the store without OPENSSL_EXTRA */ + wolfSSL_SetCertCbCtx(ssl, ssl); if (wolfSSL_connect(ssl) == WOLFSSL_SUCCESS) { printf("Client: TLS handshake success\n"); + printf("Negotiated TLS version: %s\n", wolfSSL_get_version(ssl)); int n = wolfSSL_read(ssl, buf, sizeof(buf)-1); if (n > 0) { buf[n] = 0; diff --git a/ocsp/stapling/ocsp-server.c b/ocsp/stapling/ocsp-server.c index bff8b7ca..e8668528 100644 --- a/ocsp/stapling/ocsp-server.c +++ b/ocsp/stapling/ocsp-server.c @@ -319,7 +319,7 @@ int main() } wolfSSL_Init(); - ctx = wolfSSL_CTX_new(wolfTLSv1_2_server_method()); + ctx = wolfSSL_CTX_new(wolfTLS_server_method()); if (!ctx) { fprintf(stderr, "wolfSSL_CTX_new failed\n"); goto cleanup; @@ -378,6 +378,7 @@ int main() if (wolfSSL_accept(ssl) == WOLFSSL_SUCCESS) { printf("Server: TLS handshake success\n"); + printf("Negotiated TLS version: %s\n", wolfSSL_get_version(ssl)); if (wolfSSL_write(ssl, "hello", 5) != 5) { fprintf(stderr, "Server: wolfSSL_write failed\n"); } From 4b4d179e5d6e2a7b3095a6664509b97fad2e6aa4 Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Fri, 19 Sep 2025 14:07:56 +0200 Subject: [PATCH 05/10] Add README --- ocsp/stapling/README.md | 63 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 ocsp/stapling/README.md diff --git a/ocsp/stapling/README.md b/ocsp/stapling/README.md new file mode 100644 index 00000000..6a2ef307 --- /dev/null +++ b/ocsp/stapling/README.md @@ -0,0 +1,63 @@ +# OCSP Stapling Example with wolfSSL + +This directory contains a standalone example demonstrating OCSP stapling with dynamic certificate selection and verification. Both a client and a server are provided, along with the necessary certificates and a Makefile for building the example. The certificates are taken from the wolfSSL test suite. + +## Directory Structure + +- `ocsp-server.c` — Example TLS server with OCSP stapling support. +- `ocsp-client.c` — Example TLS client that verifies OCSP staples. +- `Makefile` — Build instructions for the example programs. +- `client-certs/` — CA and intermediate certificates for client verification. +- `server-certs/` — Server certificate and private key. +- `responder-certs/` — OCSP responder certificate, key, and index file. + +## Prerequisites + +- wolfSSL library installed (headers and libraries in `/usr/local` by default). +- OpenSSL (for running a local OCSP responder). +- GNU Make and GCC. + +## Building + +To build both the server and client, simply run: + +```sh +make +``` + +This will produce two binaries: `ocsp-server` and `ocsp-client`. + +## Running the Example + +### 1. Start the OCSP Responder + +From the `stapling` directory, run: + +```sh +make responder +``` + +### 2. Start the Server + +```sh +./ocsp-server +``` + +### 3. Run the Client + +In a separate terminal, run either: + +```sh +./ocsp-client --tls12 +``` +or +```sh +./ocsp-client --tls13 +``` + +## Notes + +- The server listens on `127.0.0.1:11111`. +- The OCSP responder listens on `127.0.0.1:22221`. +- Certificates are pre-generated for demonstration purposes. +- The client and server demonstrate both automatic and manual OCSP staple verification. From fcd4e021dfe66485448dde59b770010f9ecbc1e3 Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Fri, 19 Sep 2025 14:24:25 +0200 Subject: [PATCH 06/10] instructions detailing how to build wolfSSL --- ocsp/stapling/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ocsp/stapling/README.md b/ocsp/stapling/README.md index 6a2ef307..c4b0455c 100644 --- a/ocsp/stapling/README.md +++ b/ocsp/stapling/README.md @@ -19,6 +19,14 @@ This directory contains a standalone example demonstrating OCSP stapling with dy ## Building +For this example, you need to build wolfSSL with OCSP and session certificate support. The following configuration options are required: + +```sh +./configure --enable-ocsp --enable-ocspstapling --enable-ocspstapling2 --enable-cert-setup-cb --enable-sessioncerts +make +make install +``` + To build both the server and client, simply run: ```sh From 24917b11893ba81e5091a606129727b1943e6d20 Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Mon, 22 Sep 2025 10:57:07 +0200 Subject: [PATCH 07/10] ocsp stapling: use wolf helper funcs for HTTP/TCP --- ocsp/stapling/ocsp-server.c | 179 +++++++----------------------------- 1 file changed, 35 insertions(+), 144 deletions(-) diff --git a/ocsp/stapling/ocsp-server.c b/ocsp/stapling/ocsp-server.c index e8668528..bcc2ce80 100644 --- a/ocsp/stapling/ocsp-server.c +++ b/ocsp/stapling/ocsp-server.c @@ -36,6 +36,8 @@ #define SERVER_KEY "server-certs/server1-key.pem" #define SERVER_ISSUER_CERT "client-certs/intermediate1-ca-cert.pem" #define SERVER_PORT 11111 +#define HTTP_TMP_BUFFER_SIZE 512 +#define URL_SIZE 128 static unsigned char* ocsp_resp = NULL; static int ocsp_resp_sz = 0; @@ -57,158 +59,47 @@ static int cert_cb(WOLFSSL* ssl, void* arg) int ocsp_cb(void* ctx, const char* url, int urlSz, byte* ocspReqBuf, int ocspReqSz, byte** ocspRespBuf) { - (void)ctx; - if (url == NULL || urlSz <= 0 ||ocspReqBuf == NULL || ocspReqSz <= 0 || - ocspRespBuf == NULL) { - fprintf(stderr, "ocsp_cb: invalid input\n"); - return -1; + int httpBufSz = 0; + byte httpBuf[HTTP_TMP_BUFFER_SIZE]; + char path[URL_SIZE]; + char domainName[URL_SIZE]; + word16 port = 0; + SOCKET_T sfd = SOCKET_INVALID; + int ret = -1; + int respSz = 0; + + if (wolfIO_DecodeUrl(url, urlSz, domainName, path, &port) != 0) { + WOLFSSL_MSG("Unable to decode OCSP URL"); + goto cleanup; } - // Only support http:// - const char* prefix = "http://"; - size_t prefix_len = strlen(prefix); - if (urlSz <= (int)prefix_len || strncmp(url, prefix, prefix_len) != 0) { - fprintf(stderr, "ocsp_cb: only http:// URLs are supported\n"); - return -1; + httpBufSz = wolfIO_HttpBuildRequestOcsp(domainName, path, ocspReqSz, + httpBuf, HTTP_TMP_BUFFER_SIZE); + if (wolfIO_TcpConnect(&sfd, domainName, port, 0) != 0) { + WOLFSSL_MSG("OCSP Responder connection failed"); + goto cleanup; } - // Find domain and port - const char* host_start = url + prefix_len; - const char* url_end = url + urlSz; - const char* colon = memchr(host_start, ':', url_end - host_start); - if (!colon) { - fprintf(stderr, "ocsp_cb: URL missing port\n"); - return -1; - } - const char* slash = memchr(colon, '/', url_end - colon); - size_t domain_len = colon - host_start; - size_t port_len = (slash ? (size_t)(slash - colon - 1) : (size_t)(url_end - colon - 1)); - - if (domain_len == 0 || port_len == 0) { - fprintf(stderr, "ocsp_cb: invalid domain or port in URL\n"); - return -1; + if (wolfIO_Send(sfd, (char*)httpBuf, httpBufSz, 0) != httpBufSz) { + WOLFSSL_MSG("OCSP http request failed"); + goto cleanup; } - char domain[256]; - char port[16]; - if (domain_len >= sizeof(domain) || port_len >= sizeof(port)) { - fprintf(stderr, "ocsp_cb: domain or port too long\n"); - return -1; + if (wolfIO_Send(sfd, (char*)ocspReqBuf, ocspReqSz, 0) != ocspReqSz) { + WOLFSSL_MSG("OCSP ocsp request failed"); + goto cleanup; } - memcpy(domain, host_start, domain_len); - domain[domain_len] = '\0'; - memcpy(port, colon + 1, port_len); - port[port_len] = '\0'; - - // Resolve domain and port to IP address - struct addrinfo hints, *res = NULL; - memset(&hints, 0, sizeof(hints)); - hints.ai_family = AF_INET; // IPv4 - hints.ai_socktype = SOCK_STREAM; // TCP - - int gai_ret = getaddrinfo(domain, port, &hints, &res); - if (gai_ret != 0) { - fprintf(stderr, "ocsp_cb: getaddrinfo failed: %s\n", gai_strerror(gai_ret)); - return -1; + if ((respSz = wolfIO_HttpProcessResponseOcsp((int)sfd, ocspRespBuf, httpBuf, + HTTP_TMP_BUFFER_SIZE, ctx)) <= 0) { + WOLFSSL_MSG("OCSP http response failed"); + goto cleanup; } - - // Create a socket - int sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol); - if (sock < 0) { - perror("ocsp_cb: socket"); - freeaddrinfo(res); - return -1; - } - - // Connect to the server - if (connect(sock, res->ai_addr, res->ai_addrlen) < 0) { - perror("ocsp_cb: connect"); - close(sock); - freeaddrinfo(res); - return -1; - } - - // Prepare HTTP POST header - char http_header[512]; - int header_len = snprintf( - http_header, sizeof(http_header), - "POST / HTTP/1.0\r\n" - "Host: %s\r\n" - "Content-Type: application/ocsp-request\r\n" - "Content-Length: %d\r\n" - "\r\n", - domain, ocspReqSz - ); - if (header_len < 0 || (size_t)header_len >= sizeof(http_header)) { - fprintf(stderr, "ocsp_cb: HTTP header too long\n"); - close(sock); - freeaddrinfo(res); - return -1; - } - - // Send HTTP header - if (send(sock, http_header, header_len, 0) != header_len) { - perror("ocsp_cb: send header"); - close(sock); - freeaddrinfo(res); - return -1; - } - // Send OCSP request body - if (send(sock, ocspReqBuf, ocspReqSz, 0) != ocspReqSz) { - perror("ocsp_cb: send body"); - close(sock); - freeaddrinfo(res); - return -1; - } - // Read HTTP response - char resp_buf[4096]; - int resp_len = 0; - int n; - while ((n = recv(sock, resp_buf + resp_len, sizeof(resp_buf) - resp_len, 0)) > 0) { - resp_len += n; - if (resp_len >= (int)sizeof(resp_buf)) { - fprintf(stderr, "ocsp_cb: response too large\n"); - close(sock); - freeaddrinfo(res); - return -1; - } - } - if (n < 0) { - perror("ocsp_cb: recv"); - close(sock); - freeaddrinfo(res); - return -1; - } - close(sock); - freeaddrinfo(res); - - // Find end of HTTP headers - char* body = NULL; - int body_len = 0; - char* header_end = NULL; - header_end = strstr(resp_buf, "\r\n\r\n"); - if (!header_end) { - fprintf(stderr, "ocsp_cb: malformed HTTP response\n"); - return -1; - } - body = header_end + 4; - body_len = resp_len - (body - resp_buf); - if (body_len <= 0) { - fprintf(stderr, "ocsp_cb: empty HTTP body\n"); - return -1; - } - - // Allocate and copy OCSP response body - ocsp_resp = *ocspRespBuf = (byte*)malloc(body_len); - ocsp_resp_sz = body_len; - if (!*ocspRespBuf) { - fprintf(stderr, "ocsp_cb: malloc failed\n"); - return -1; - } - memcpy(*ocspRespBuf, body, body_len); - - // Return the length of the OCSP response body - return body_len; + ocsp_resp = *ocspRespBuf; + ocsp_resp_sz = ret = respSz; +cleanup: + if (sfd != SOCKET_INVALID) + CloseSocket(sfd); + return ret; } static int fetch_ocsp_response(unsigned char** resp, int* respSz) From 90cf8cb0bf1f58145ca256518bd15b3a0c98b2eb Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Mon, 22 Sep 2025 17:29:59 +0200 Subject: [PATCH 08/10] Explain cert_cb --- ocsp/stapling/ocsp-server.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ocsp/stapling/ocsp-server.c b/ocsp/stapling/ocsp-server.c index bcc2ce80..5b87e5c3 100644 --- a/ocsp/stapling/ocsp-server.c +++ b/ocsp/stapling/ocsp-server.c @@ -42,6 +42,9 @@ static unsigned char* ocsp_resp = NULL; static int ocsp_resp_sz = 0; +/* This callback can be used to choose between multiple certs/keys. It can + * be used to select certs based on SNI, ciphersuites, etc. Here we just + * load a single cert/key. */ static int cert_cb(WOLFSSL* ssl, void* arg) { (void)arg; From 3c71b1eeacf819d28195d89a783662621c858522 Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Wed, 24 Sep 2025 19:31:16 +0200 Subject: [PATCH 09/10] Sync with latest wolfssl commit - All OCSP verification is done in OCSP callback - Exit with error code on failure - Send chain (still only stapling leaf) --- ocsp/stapling/Makefile | 2 +- ocsp/stapling/ocsp-client.c | 55 ++++++++++++++++--------------------- ocsp/stapling/ocsp-server.c | 10 +++++-- 3 files changed, 31 insertions(+), 36 deletions(-) diff --git a/ocsp/stapling/Makefile b/ocsp/stapling/Makefile index 6602ccc0..f6b5af5b 100644 --- a/ocsp/stapling/Makefile +++ b/ocsp/stapling/Makefile @@ -35,7 +35,7 @@ debug: all responder: openssl ocsp -index responder-certs/index.txt -port 22221 \ -rsigner responder-certs/ocsp-responder-cert.pem \ - -rkey \responder-certs/ocsp-responder-key.pem \ + -rkey responder-certs/ocsp-responder-key.pem \ -CA client-certs/intermediate1-ca-cert.pem clean: diff --git a/ocsp/stapling/ocsp-client.c b/ocsp/stapling/ocsp-client.c index 46e5129b..00d728bd 100644 --- a/ocsp/stapling/ocsp-client.c +++ b/ocsp/stapling/ocsp-client.c @@ -57,12 +57,11 @@ static int cert_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store) || err == WOLFSSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT #endif ) { - + int i; WOLFSSL_BUFFER_INFO* bInfo = &store->certs[depth]; WOLFSSL_CERT_MANAGER* cm = NULL; DecodedCert cert; byte certInit = 0; - WOLFSSL* ssl = (WOLFSSL*)store->userCtx; cm = wolfSSL_CertManagerNew(); if (cm == NULL) @@ -70,10 +69,13 @@ static int cert_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store) if (ret == 1 && wolfSSL_CertManagerLoadCA(cm, CA_CERT, NULL) != WOLFSSL_SUCCESS) ret = 0; - /* If verifying leaf cert then we need to load the intermediate CA */ - if (ret == 1 && depth == 0 && - wolfSSL_CertManagerLoadCA(cm, INTERMEDIATE_CA_CERT, NULL) != WOLFSSL_SUCCESS) - ret = 0; + + /* Certs are verified top down so we can load the remainder of the chain */ + for (i = depth + 1; i < store->totalCerts && ret == 1; i++) { + if (wolfSSL_CertManagerLoadCABuffer(cm, store->certs[i].buffer, store->certs[i].length, + WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) + ret = 0; + } /* Verify cert with CA */ if (ret == 1) { @@ -83,27 +85,6 @@ static int cert_verify_cb(int preverify, WOLFSSL_X509_STORE_CTX* store) if (ret == 1 && wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0) ret = 0; - if (ret == 1 && (wolfSSL_version(ssl) == TLS1_3_VERSION || - wolfSSL_version(ssl) == DTLS1_3_VERSION)) { - WOLFSSL_BUFFER_INFO* ocspStaple = wolfSSL_GetTls13OcspStatusResp(ssl, (word32)depth); - WOLFSSL_OCSP* ocsp = NULL; - - if (ocspStaple == NULL || ocspStaple->buffer == NULL ||ocspStaple->length == 0) - ret = 0; - if (ret == 1 && (ocsp = wc_NewOCSP(cm)) == NULL) - ret = 0; - if (ret == 1 && - wc_CheckCertOcspResponse(ocsp, &cert, ocspStaple->buffer, - ocspStaple->length, NULL) != 0) - ret = 0; - wc_FreeOCSP(ocsp); - - if (ret == 1) - printf("Client: Manual OCSP staple verification succeeded at depth %d\n", depth); - else - printf("Client: Manual OCSP staple verification failed at depth %d\n", depth); - } - if (certInit) wc_FreeDecodedCert(&cert); wolfSSL_CertManagerFree(cm); @@ -135,21 +116,26 @@ static int ocsp_verify_cb(WOLFSSL* ssl, int err, unsigned char* staple, unsigned WOLFSSL_CERT_MANAGER* cm = NULL; DecodedCert cert; byte certInit = 0; - WOLFSSL_OCSP* ocsp; + WOLFSSL_OCSP* ocsp = NULL; WOLFSSL_X509_CHAIN* peerCerts; + int i; cm = wolfSSL_CertManagerNew(); if (cm == NULL) goto cleanup; if (wolfSSL_CertManagerLoadCA(cm, CA_CERT, NULL) != WOLFSSL_SUCCESS) goto cleanup; - if (wolfSSL_CertManagerLoadCA(cm, INTERMEDIATE_CA_CERT, NULL) != WOLFSSL_SUCCESS) - goto cleanup; peerCerts = wolfSSL_get_peer_chain(ssl); if (peerCerts == NULL || wolfSSL_get_chain_count(peerCerts) <= (int)idx) goto cleanup; + for (i = idx + 1; i < wolfSSL_get_chain_count(peerCerts); i++) { + if (wolfSSL_CertManagerLoadCABuffer(cm, wolfSSL_get_chain_cert(peerCerts, i), + wolfSSL_get_chain_length(peerCerts, i), WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) + goto cleanup; + } + wc_InitDecodedCert(&cert, wolfSSL_get_chain_cert(peerCerts, idx), wolfSSL_get_chain_length(peerCerts, idx), NULL); certInit = 1; if (wc_ParseCert(&cert, CERT_TYPE, VERIFY, cm) != 0) @@ -182,6 +168,7 @@ int main(int argc, char** argv) WOLFSSL* ssl = NULL; char buf[32]; int use_tls13 = 0; + int ret = 1; if (argc != 2) { printf("Usage: %s [--tls12|--tls13]\n", argv[0]); @@ -223,7 +210,7 @@ int main(int argc, char** argv) goto cleanup; } } - wolfSSL_CTX_set_tls12_ocsp_status_verify_cb(ctx, ocsp_verify_cb, NULL); + wolfSSL_CTX_set_ocsp_status_verify_cb(ctx, ocsp_verify_cb, NULL); sockfd = socket(AF_INET, SOCK_STREAM, 0); if (sockfd < 0) { @@ -258,17 +245,21 @@ int main(int argc, char** argv) if (n > 0) { buf[n] = 0; printf("Client: received: %s\n", buf); + ret = 0; } else if (n < 0) { fprintf(stderr, "Client: wolfSSL_read failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + goto cleanup; } } else { fprintf(stderr, "Client: TLS handshake failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + goto cleanup; } + ret = 0; cleanup: if (ssl) wolfSSL_free(ssl); if (sockfd >= 0) close(sockfd); if (ctx) wolfSSL_CTX_free(ctx); wolfSSL_Cleanup(); - return 0; + return ret; } diff --git a/ocsp/stapling/ocsp-server.c b/ocsp/stapling/ocsp-server.c index 5b87e5c3..c6a8bee4 100644 --- a/ocsp/stapling/ocsp-server.c +++ b/ocsp/stapling/ocsp-server.c @@ -48,7 +48,7 @@ static int ocsp_resp_sz = 0; static int cert_cb(WOLFSSL* ssl, void* arg) { (void)arg; - if (wolfSSL_use_certificate_file(ssl, SERVER_CERT, WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) { + if (wolfSSL_use_certificate_chain_file(ssl, SERVER_CERT) != WOLFSSL_SUCCESS) { fprintf(stderr, "Error loading server certificate: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); return 0; } @@ -196,7 +196,7 @@ static int status_cb(WOLFSSL* ssl, void* ctx) return WOLFSSL_OCSP_STATUS_CB_ALERT_FATAL; } - // wolfSSL takes ownership of resp_buf, so do not free it here + /* wolfSSL takes ownership of resp_buf, so do not free it here */ return WOLFSSL_OCSP_STATUS_CB_OK; } @@ -206,6 +206,7 @@ int main() struct sockaddr_in serv_addr; WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; + int ret = 1; if (fetch_ocsp_response(&ocsp_resp, &ocsp_resp_sz) != 0) { fprintf(stderr, "Failed to fetch OCSP response at startup\n"); @@ -275,16 +276,19 @@ int main() printf("Negotiated TLS version: %s\n", wolfSSL_get_version(ssl)); if (wolfSSL_write(ssl, "hello", 5) != 5) { fprintf(stderr, "Server: wolfSSL_write failed\n"); + goto cleanup; } } else { fprintf(stderr, "Server: TLS handshake failed: %s\n", wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0))); + goto cleanup; } + ret = 0; cleanup: if (ssl) wolfSSL_free(ssl); if (connfd >= 0) close(connfd); if (listenfd >= 0) close(listenfd); if (ctx) wolfSSL_CTX_free(ctx); wolfSSL_Cleanup(); - return 0; + return ret; } From 3b15cf53ea84b839d4b3394854a160ee430ac5f1 Mon Sep 17 00:00:00 2001 From: Juliusz Sosinowicz Date: Fri, 3 Oct 2025 16:51:58 +0200 Subject: [PATCH 10/10] Fix comment --- ocsp/stapling/ocsp-server.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ocsp/stapling/ocsp-server.c b/ocsp/stapling/ocsp-server.c index c6a8bee4..d758f936 100644 --- a/ocsp/stapling/ocsp-server.c +++ b/ocsp/stapling/ocsp-server.c @@ -162,9 +162,8 @@ static int fetch_ocsp_response(unsigned char** resp, int* respSz) } wolfSSL_CertManagerSetOCSP_Cb(cm, ocsp_cb, NULL, NULL); - /* Note: This does not return the raw OCSP response, just verifies. */ + /* This calls ocsp_cb to fetch the response and verifies it. ocsp_cb stores the response globally. */ if (wolfSSL_CertManagerCheckOCSP(cm, certDer, certDerSz) == WOLFSSL_SUCCESS) { - /* For real stapling, you would fetch and set the actual OCSP response here. */ ret = 0; } else { fprintf(stderr, "wolfSSL_CertManagerCheckOCSP failed or OCSP not verified\n");