Skip to content

Commit ce5512d

Browse files
author
Divjot Arora
authored
Specify behavior for validating OCSP responses (#724)
1 parent f3f2ac3 commit ce5512d

File tree

2 files changed

+24
-16
lines changed

2 files changed

+24
-16
lines changed

‎source/ocsp-support/ocsp-support.rst

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ OCSP Support
33
============
44

55
:Spec Title: OCSP Support
6-
:Spec Version: 1.1.0
6+
:Spec Version: 1.1.1
77
:Author: Vincent Kam
88
:Lead: Jeremy Mikola
99
:Advisory Group: Clyde Bazile *(POC author)*, Esha Bhargava *(Program Manager)*, Matt Broadstone, Bernie Hackett *(POC author)*, Shreyas Kaylan *(Server Project Lead)*, Jeremy Mikola *(Spec Lead)*
@@ -78,8 +78,9 @@ invalid, the driver SHOULD end the connection.
7878
stapled OCSP response, a driver SHOULD end the connection.
7979

8080
2. If a driver’s TLS library supports Stapled OCSP and the server
81-
staples an OCSP response that does not cover the certificate it
82-
presents, a driver SHOULD end the connection.
81+
staples an OCSP response that does not cover the certificate it presents or
82+
is invalid per `RFC 6960 Section 3.2 <https://tools.ietf.org/html/rfc6960#section-3.2>`_,
83+
a driver SHOULD end the connection.
8384

8485
3. If a driver’s TLS library supports Stapled OCSP and the server
8586
staples an OCSP response that does cover the certificate it
@@ -102,9 +103,13 @@ invalid, the driver SHOULD end the connection.
102103
attempt to validate the status of the unvalidated certificates
103104
using the cached CRLs.
104105

105-
7. If the server’s certificate remains unvalidated and that certificate
106-
has an OCSP endpoint, the driver SHOULD reach out to the OCSP
107-
endpoint specified and attempt to validate that certificate.
106+
7. If the server's certificate remains unvalidated and that certificate
107+
has a list of OCSP responder endpoints, the driver SHOULD send HTTP
108+
requests to the responders in parallel. The first valid response
109+
that concretely marks the certificate status as good or revoked
110+
should be used. A five-second timeout SHOULD be used for the requests.
111+
The status for a response should only be checked if the response is
112+
valid per `RFC 6960 Section 3.2 <https://tools.ietf.org/html/rfc6960#section-3.2>`_
108113

109114
8. If any unvalidated intermediate certificates remain and those
110115
certificates have OCSP endpoints, for each certificate, the
@@ -117,8 +122,8 @@ invalid, the driver SHOULD end the connection.
117122
the other certificates using those CRLs.\*
118123

119124
10. Finally, the driver SHOULD continue the connection, even if the
120-
status of all the unvalidated intermediate certificates has not
121-
been confirmed yet. This means that the driver SHOULD default to
125+
status of all the unvalidated certificates has not been
126+
confirmed yet. This means that the driver SHOULD default to
122127
“soft fail” behavior, connecting as long as there are no
123128
explicitly invalid certificates—i.e. the driver will connect
124129
even if the status of all the unvalidated certificates has not
@@ -643,13 +648,14 @@ of checking this are:
643648

644649
Changelog
645650
==========
651+
**2020-2-19**: Clarify behavior for reaching out to OCSP responders.
652+
646653
**2020-2-10**: 1.1.0: Add cache requirement.
647654

648655
**2020-1-31**: 1.0.2: Add SNI requirement and clarify design rationale
649656
regarding minimizing round trips.
650657

651-
**2020-1-28**: 1.0.1: Clarify behavior regarding nonces and tolerance
652-
periods.
658+
**2020-1-28**: Clarify behavior regarding nonces and tolerance periods.
653659

654660
**2020-1-16**: 1.0.0: Initial commit.
655661

‎source/ocsp-support/tests/README.rst

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ malicious server cases.
4949

5050
+----------------------------------------+-----------------------------------------+-------------------------------------------+-------------------------------------------------+---------------------------------------------------+-----------------------------------------------------+-----------------------------------------------------------------------+--------------------------------------------------------------------+
5151
| **URI options** | **Test 1\:** | **Test 2\:** | **Test 3\:** | **Test 4\:** | **Soft Fail Test\:** | **Malicious Server Test 1\:** | **Malicious Server Test 2\: No OCSP Responder + server w/ Must-** |
52-
| | **Valid cert + server that staples** | **Invalid cert + server that staples** | **Valid cert + server that does not staple** | **Invalid cert + server that does not staple** | | **Invalid cert + server w/ Must- Staple cert that does not staple** | **Staple cert that does not staple** |
52+
| | **Valid cert + server that staples** | **Invalid cert + server that staples** | **Valid cert + server that does not staple** | **Invalid cert + server that does not staple** | **No OCSP Responder + server that does not staple** | **Invalid cert + server w/ Must- Staple cert that does not staple** | **Staple cert that does not staple** |
5353
+========================================+=========================================+===========================================+=================================================+===================================================+=====================================================+=======================================================================+====================================================================+
5454
| ``tls=true`` | OK | FAIL | OK | FAIL | OK\* | FAIL\* | FAIL\* |
5555
+----------------------------------------+-----------------------------------------+-------------------------------------------+-------------------------------------------------+---------------------------------------------------+-----------------------------------------------------+-----------------------------------------------------------------------+--------------------------------------------------------------------+
@@ -67,8 +67,9 @@ to determine which versions of the server can be used for each column.
6767
Note: From the perspective of a driver that does not support OCSP
6868
stapling, the following sets of tests should be identical: {Test 1, Test
6969
3}, {Test 2, Test 4, Malicious Server Test 1}, and {Soft Fail Test,
70-
Malicious Server Test 2}. However, it does no harm to test these extra
71-
cases and may help reveal unexpected behavior.
70+
Malicious Server Test 2}. For drivers with full control over their OCSP behavior, both malicious
71+
server tests are identical as well. However, it does no harm to test these
72+
extra cases and may help reveal unexpected behavior.
7273

7374
\*: Drivers that cannot pass these tests due to limitations in their TLS
7475
library’s implementation of OCSP will need to document these failures as
@@ -91,8 +92,9 @@ certificate is invalid.
9192
The mongo-orchestration configurations needed for testing can be found
9293
at ``.evergreen/orchestration/configs/servers/``. Tests that specify that a
9394
server should staple MUST use ``basic-tls-ocsp-mustStaple.json``. Tests that
94-
specify that a server should not staple MUST use ``basic-tls-ocsp.json``.
95-
The malicious server tests MUST use ``basic-tls-ocsp-mustStaple.json``.
95+
specify that a server should not staple MUST use
96+
``basic-tls-ocsp-disableStapling.json``. The malicious server tests MUST use
97+
``basic-tls-ocsp-mustStaple-disableStapling.json``.
9698

9799
Test Procedure
98100
==============
@@ -114,7 +116,7 @@ for instructions on how to clear OS-level OCSP caches.
114116

115117
Ensure that a mongod is running with the correct certificate chain (see
116118
`Mock OCSP Responder Testing
117-
Suite <../ocsp-support.rst#mock-ocsp-responder-testing-suite>`__
119+
Suite `<#mock-ocsp-responder-testing-suite>`__
118120
for configuration details) and that the mock OCSP responder is configured
119121
to report the expected revocation status for that certificate. Again, each
120122
test column MUST BE its own Evergreen task in order to minimize the impact

0 commit comments

Comments
 (0)