644 lines
22 KiB
HTML
644 lines
22 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of OCSP</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>OCSP</H1>
|
|
Section: OpenSSL (1SSL)<BR>Updated: 2021-03-22<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
openssl-ocsp, ocsp - Online Certificate Status Protocol utility
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
|
|
|
|
<B>openssl</B> <B>ocsp</B>
|
|
[<B>-help</B>]
|
|
[<B>-out file</B>]
|
|
[<B>-issuer file</B>]
|
|
[<B>-cert file</B>]
|
|
[<B>-serial n</B>]
|
|
[<B>-signer file</B>]
|
|
[<B>-signkey file</B>]
|
|
[<B>-sign_other file</B>]
|
|
[<B>-no_certs</B>]
|
|
[<B>-req_text</B>]
|
|
[<B>-resp_text</B>]
|
|
[<B>-text</B>]
|
|
[<B>-reqout file</B>]
|
|
[<B>-respout file</B>]
|
|
[<B>-reqin file</B>]
|
|
[<B>-respin file</B>]
|
|
[<B>-nonce</B>]
|
|
[<B>-no_nonce</B>]
|
|
[<B>-url </B><FONT SIZE="-1"><B>URL</B></FONT><B></B>]
|
|
[<B>-host host:port</B>]
|
|
[<B>-multi process-count</B>]
|
|
[<B>-header</B>]
|
|
[<B>-path</B>]
|
|
[<B>-CApath dir</B>]
|
|
[<B>-CAfile file</B>]
|
|
[<B>-no-CAfile</B>]
|
|
[<B>-no-CApath</B>]
|
|
[<B>-attime timestamp</B>]
|
|
[<B>-check_ss_sig</B>]
|
|
[<B>-crl_check</B>]
|
|
[<B>-crl_check_all</B>]
|
|
[<B>-explicit_policy</B>]
|
|
[<B>-extended_crl</B>]
|
|
[<B>-ignore_critical</B>]
|
|
[<B>-inhibit_any</B>]
|
|
[<B>-inhibit_map</B>]
|
|
[<B>-no_check_time</B>]
|
|
[<B>-partial_chain</B>]
|
|
[<B>-policy arg</B>]
|
|
[<B>-policy_check</B>]
|
|
[<B>-policy_print</B>]
|
|
[<B>-purpose purpose</B>]
|
|
[<B>-suiteB_128</B>]
|
|
[<B>-suiteB_128_only</B>]
|
|
[<B>-suiteB_192</B>]
|
|
[<B>-trusted_first</B>]
|
|
[<B>-no_alt_chains</B>]
|
|
[<B>-use_deltas</B>]
|
|
[<B>-auth_level num</B>]
|
|
[<B>-verify_depth num</B>]
|
|
[<B>-verify_email email</B>]
|
|
[<B>-verify_hostname hostname</B>]
|
|
[<B>-verify_ip ip</B>]
|
|
[<B>-verify_name name</B>]
|
|
[<B>-x509_strict</B>]
|
|
[<B>-VAfile file</B>]
|
|
[<B>-validity_period n</B>]
|
|
[<B>-status_age n</B>]
|
|
[<B>-noverify</B>]
|
|
[<B>-verify_other file</B>]
|
|
[<B>-trust_other</B>]
|
|
[<B>-no_intern</B>]
|
|
[<B>-no_signature_verify</B>]
|
|
[<B>-no_cert_verify</B>]
|
|
[<B>-no_chain</B>]
|
|
[<B>-no_cert_checks</B>]
|
|
[<B>-no_explicit</B>]
|
|
[<B>-port num</B>]
|
|
[<B>-ignore_err</B>]
|
|
[<B>-index file</B>]
|
|
[<B>-CA file</B>]
|
|
[<B>-rsigner file</B>]
|
|
[<B>-rkey file</B>]
|
|
[<B>-rother file</B>]
|
|
[<B>-rsigopt nm:v</B>]
|
|
[<B>-resp_no_certs</B>]
|
|
[<B>-nmin n</B>]
|
|
[<B>-ndays n</B>]
|
|
[<B>-resp_key_id</B>]
|
|
[<B>-nrequest n</B>]
|
|
[<B>-</B>digest<B></B>]
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
|
|
|
|
The Online Certificate Status Protocol (<FONT SIZE="-1">OCSP</FONT>) enables applications to
|
|
determine the (revocation) state of an identified certificate (<FONT SIZE="-1">RFC 2560</FONT>).
|
|
<P>
|
|
|
|
The <B>ocsp</B> command performs many common <FONT SIZE="-1">OCSP</FONT> tasks. It can be used
|
|
to print out requests and responses, create requests and send queries
|
|
to an <FONT SIZE="-1">OCSP</FONT> responder and behave like a mini <FONT SIZE="-1">OCSP</FONT> server itself.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
|
|
|
|
This command operates as either a client or a server.
|
|
The options are described below, divided into those two modes.
|
|
<A NAME="lbAF"> </A>
|
|
<H3><FONT SIZE="-1">OCSP</FONT> Client Options</H3>
|
|
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-help</B><DD>
|
|
|
|
|
|
Print out a usage message.
|
|
<DT id="2"><B>-out filename</B><DD>
|
|
|
|
|
|
specify output filename, default is standard output.
|
|
<DT id="3"><B>-issuer filename</B><DD>
|
|
|
|
|
|
This specifies the current issuer certificate. This option can be used
|
|
multiple times. The certificate specified in <B>filename</B> must be in
|
|
<FONT SIZE="-1">PEM</FONT> format. This option <B></B><FONT SIZE="-1"><B>MUST</B></FONT><B></B> come before any <B>-cert</B> options.
|
|
<DT id="4"><B>-cert filename</B><DD>
|
|
|
|
|
|
Add the certificate <B>filename</B> to the request. The issuer certificate
|
|
is taken from the previous <B>issuer</B> option, or an error occurs if no
|
|
issuer certificate is specified.
|
|
<DT id="5"><B>-serial num</B><DD>
|
|
|
|
|
|
Same as the <B>cert</B> option except the certificate with serial number
|
|
<B>num</B> is added to the request. The serial number is interpreted as a
|
|
decimal integer unless preceded by <B>0x</B>. Negative integers can also
|
|
be specified by preceding the value by a <B>-</B> sign.
|
|
<DT id="6"><B>-signer filename</B>, <B>-signkey filename</B><DD>
|
|
|
|
|
|
Sign the <FONT SIZE="-1">OCSP</FONT> request using the certificate specified in the <B>signer</B>
|
|
option and the private key specified by the <B>signkey</B> option. If
|
|
the <B>signkey</B> option is not present then the private key is read
|
|
from the same file as the certificate. If neither option is specified then
|
|
the <FONT SIZE="-1">OCSP</FONT> request is not signed.
|
|
<DT id="7"><B>-sign_other filename</B><DD>
|
|
|
|
|
|
Additional certificates to include in the signed request.
|
|
<DT id="8"><B>-nonce</B>, <B>-no_nonce</B><DD>
|
|
|
|
|
|
Add an <FONT SIZE="-1">OCSP</FONT> nonce extension to a request or disable <FONT SIZE="-1">OCSP</FONT> nonce addition.
|
|
Normally if an <FONT SIZE="-1">OCSP</FONT> request is input using the <B>reqin</B> option no
|
|
nonce is added: using the <B>nonce</B> option will force addition of a nonce.
|
|
If an <FONT SIZE="-1">OCSP</FONT> request is being created (using <B>cert</B> and <B>serial</B> options)
|
|
a nonce is automatically added specifying <B>no_nonce</B> overrides this.
|
|
<DT id="9"><B>-req_text</B>, <B>-resp_text</B>, <B>-text</B><DD>
|
|
|
|
|
|
Print out the text form of the <FONT SIZE="-1">OCSP</FONT> request, response or both respectively.
|
|
<DT id="10"><B>-reqout file</B>, <B>-respout file</B><DD>
|
|
|
|
|
|
Write out the <FONT SIZE="-1">DER</FONT> encoded certificate request or response to <B>file</B>.
|
|
<DT id="11"><B>-reqin file</B>, <B>-respin file</B><DD>
|
|
|
|
|
|
Read <FONT SIZE="-1">OCSP</FONT> request or response file from <B>file</B>. These option are ignored
|
|
if <FONT SIZE="-1">OCSP</FONT> request or response creation is implied by other options (for example
|
|
with <B>serial</B>, <B>cert</B> and <B>host</B> options).
|
|
<DT id="12"><B>-url responder_url</B><DD>
|
|
|
|
|
|
Specify the responder <FONT SIZE="-1">URL.</FONT> Both <FONT SIZE="-1">HTTP</FONT> and <FONT SIZE="-1">HTTPS</FONT> (<FONT SIZE="-1">SSL/TLS</FONT>) URLs can be specified.
|
|
<DT id="13"><B>-host hostname:port</B>, <B>-path pathname</B><DD>
|
|
|
|
|
|
If the <B>host</B> option is present then the <FONT SIZE="-1">OCSP</FONT> request is sent to the host
|
|
<B>hostname</B> on port <B>port</B>. <B>path</B> specifies the <FONT SIZE="-1">HTTP</FONT> path name to use
|
|
or ``/'' by default. This is equivalent to specifying <B>-url</B> with scheme
|
|
http:// and the given hostname, port, and pathname.
|
|
<DT id="14"><B>-header name=value</B><DD>
|
|
|
|
|
|
Adds the header <B>name</B> with the specified <B>value</B> to the <FONT SIZE="-1">OCSP</FONT> request
|
|
that is sent to the responder.
|
|
This may be repeated.
|
|
<DT id="15"><B>-timeout seconds</B><DD>
|
|
|
|
|
|
Connection timeout to the <FONT SIZE="-1">OCSP</FONT> responder in seconds.
|
|
On <FONT SIZE="-1">POSIX</FONT> systems, when running as an <FONT SIZE="-1">OCSP</FONT> responder, this option also limits
|
|
the time that the responder is willing to wait for the client request.
|
|
This time is measured from the time the responder accepts the connection until
|
|
the complete request is received.
|
|
<DT id="16"><B>-multi process-count</B><DD>
|
|
|
|
|
|
Run the specified number of <FONT SIZE="-1">OCSP</FONT> responder child processes, with the parent
|
|
process respawning child processes as needed.
|
|
Child processes will detect changes in the <FONT SIZE="-1">CA</FONT> index file and automatically
|
|
reload it.
|
|
When running as a responder <B>-timeout</B> option is recommended to limit the time
|
|
each child is willing to wait for the client's <FONT SIZE="-1">OCSP</FONT> response.
|
|
This option is available on <FONT SIZE="-1">POSIX</FONT> systems (that support the <B>fork()</B> and other
|
|
required unix system-calls).
|
|
<DT id="17"><B>-CAfile file</B>, <B>-CApath pathname</B><DD>
|
|
|
|
|
|
File or pathname containing trusted <FONT SIZE="-1">CA</FONT> certificates. These are used to verify
|
|
the signature on the <FONT SIZE="-1">OCSP</FONT> response.
|
|
<DT id="18"><B>-no-CAfile</B><DD>
|
|
|
|
|
|
Do not load the trusted <FONT SIZE="-1">CA</FONT> certificates from the default file location
|
|
<DT id="19"><B>-no-CApath</B><DD>
|
|
|
|
|
|
Do not load the trusted <FONT SIZE="-1">CA</FONT> certificates from the default directory location
|
|
<DT id="20"><B>-attime</B>, <B>-check_ss_sig</B>, <B>-crl_check</B>, <B>-crl_check_all</B>, <B>-explicit_policy</B>, <B>-extended_crl</B>, <B>-ignore_critical</B>, <B>-inhibit_any</B>, <B>-inhibit_map</B>, <B>-no_alt_chains</B>, <B>-no_check_time</B>, <B>-partial_chain</B>, <B>-policy</B>, <B>-policy_check</B>, <B>-policy_print</B>, <B>-purpose</B>, <B>-suiteB_128</B>, <B>-suiteB_128_only</B>, <B>-suiteB_192</B>, <B>-trusted_first</B>, <B>-use_deltas</B>, <B>-auth_level</B>, <B>-verify_depth</B>, <B>-verify_email</B>, <B>-verify_hostname</B>, <B>-verify_ip</B>, <B>-verify_name</B>, <B>-x509_strict</B><DD>
|
|
|
|
|
|
Set different certificate verification options.
|
|
See <B><A HREF="/cgi-bin/man/man2html?1+verify">verify</A></B>(1) manual page for details.
|
|
<DT id="21"><B>-verify_other file</B><DD>
|
|
|
|
|
|
File containing additional certificates to search when attempting to locate
|
|
the <FONT SIZE="-1">OCSP</FONT> response signing certificate. Some responders omit the actual signer's
|
|
certificate from the response: this option can be used to supply the necessary
|
|
certificate in such cases.
|
|
<DT id="22"><B>-trust_other</B><DD>
|
|
|
|
|
|
The certificates specified by the <B>-verify_other</B> option should be explicitly
|
|
trusted and no additional checks will be performed on them. This is useful
|
|
when the complete responder certificate chain is not available or trusting a
|
|
root <FONT SIZE="-1">CA</FONT> is not appropriate.
|
|
<DT id="23"><B>-VAfile file</B><DD>
|
|
|
|
|
|
File containing explicitly trusted responder certificates. Equivalent to the
|
|
<B>-verify_other</B> and <B>-trust_other</B> options.
|
|
<DT id="24"><B>-noverify</B><DD>
|
|
|
|
|
|
Don't attempt to verify the <FONT SIZE="-1">OCSP</FONT> response signature or the nonce
|
|
values. This option will normally only be used for debugging since it
|
|
disables all verification of the responders certificate.
|
|
<DT id="25"><B>-no_intern</B><DD>
|
|
|
|
|
|
Ignore certificates contained in the <FONT SIZE="-1">OCSP</FONT> response when searching for the
|
|
signers certificate. With this option the signers certificate must be specified
|
|
with either the <B>-verify_other</B> or <B>-VAfile</B> options.
|
|
<DT id="26"><B>-no_signature_verify</B><DD>
|
|
|
|
|
|
Don't check the signature on the <FONT SIZE="-1">OCSP</FONT> response. Since this option
|
|
tolerates invalid signatures on <FONT SIZE="-1">OCSP</FONT> responses it will normally only be
|
|
used for testing purposes.
|
|
<DT id="27"><B>-no_cert_verify</B><DD>
|
|
|
|
|
|
Don't verify the <FONT SIZE="-1">OCSP</FONT> response signers certificate at all. Since this
|
|
option allows the <FONT SIZE="-1">OCSP</FONT> response to be signed by any certificate it should
|
|
only be used for testing purposes.
|
|
<DT id="28"><B>-no_chain</B><DD>
|
|
|
|
|
|
Do not use certificates in the response as additional untrusted <FONT SIZE="-1">CA</FONT>
|
|
certificates.
|
|
<DT id="29"><B>-no_explicit</B><DD>
|
|
|
|
|
|
Do not explicitly trust the root <FONT SIZE="-1">CA</FONT> if it is set to be trusted for <FONT SIZE="-1">OCSP</FONT> signing.
|
|
<DT id="30"><B>-no_cert_checks</B><DD>
|
|
|
|
|
|
Don't perform any additional checks on the <FONT SIZE="-1">OCSP</FONT> response signers certificate.
|
|
That is do not make any checks to see if the signers certificate is authorised
|
|
to provide the necessary status information: as a result this option should
|
|
only be used for testing purposes.
|
|
<DT id="31"><B>-validity_period nsec</B>, <B>-status_age age</B><DD>
|
|
|
|
|
|
These options specify the range of times, in seconds, which will be tolerated
|
|
in an <FONT SIZE="-1">OCSP</FONT> response. Each certificate status response includes a <B>notBefore</B>
|
|
time and an optional <B>notAfter</B> time. The current time should fall between
|
|
these two values, but the interval between the two times may be only a few
|
|
seconds. In practice the <FONT SIZE="-1">OCSP</FONT> responder and clients clocks may not be precisely
|
|
synchronised and so such a check may fail. To avoid this the
|
|
<B>-validity_period</B> option can be used to specify an acceptable error range in
|
|
seconds, the default value is 5 minutes.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
If the <B>notAfter</B> time is omitted from a response then this means that new
|
|
status information is immediately available. In this case the age of the
|
|
<B>notBefore</B> field is checked to see it is not older than <B>age</B> seconds old.
|
|
By default this additional check is not performed.
|
|
<DT id="32"><B>-</B>digest<B></B><DD>
|
|
|
|
|
|
This option sets digest algorithm to use for certificate identification in the
|
|
<FONT SIZE="-1">OCSP</FONT> request. Any digest supported by the OpenSSL <B>dgst</B> command can be used.
|
|
The default is <FONT SIZE="-1">SHA-1.</FONT> This option may be used multiple times to specify the
|
|
digest used by subsequent certificate identifiers.
|
|
</DL>
|
|
<A NAME="lbAG"> </A>
|
|
<H3><FONT SIZE="-1">OCSP</FONT> Server Options</H3>
|
|
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="33"><B>-index indexfile</B><DD>
|
|
|
|
|
|
The <B>indexfile</B> parameter is the name of a text index file in <B>ca</B>
|
|
format containing certificate revocation information.
|
|
|
|
|
|
<P>
|
|
|
|
|
|
If the <B>index</B> option is specified the <B>ocsp</B> utility is in responder
|
|
mode, otherwise it is in client mode. The request(s) the responder
|
|
processes can be either specified on the command line (using <B>issuer</B>
|
|
and <B>serial</B> options), supplied in a file (using the <B>reqin</B> option)
|
|
or via external <FONT SIZE="-1">OCSP</FONT> clients (if <B>port</B> or <B>url</B> is specified).
|
|
|
|
|
|
<P>
|
|
|
|
|
|
If the <B>index</B> option is present then the <B></B><FONT SIZE="-1"><B>CA</B></FONT><B></B> and <B>rsigner</B> options
|
|
must also be present.
|
|
<DT id="34"><B>-CA file</B><DD>
|
|
|
|
|
|
<FONT SIZE="-1">CA</FONT> certificate corresponding to the revocation information in <B>indexfile</B>.
|
|
<DT id="35"><B>-rsigner file</B><DD>
|
|
|
|
|
|
The certificate to sign <FONT SIZE="-1">OCSP</FONT> responses with.
|
|
<DT id="36"><B>-rother file</B><DD>
|
|
|
|
|
|
Additional certificates to include in the <FONT SIZE="-1">OCSP</FONT> response.
|
|
<DT id="37"><B>-resp_no_certs</B><DD>
|
|
|
|
|
|
Don't include any certificates in the <FONT SIZE="-1">OCSP</FONT> response.
|
|
<DT id="38"><B>-resp_key_id</B><DD>
|
|
|
|
|
|
Identify the signer certificate using the key <FONT SIZE="-1">ID,</FONT> default is to use the
|
|
subject name.
|
|
<DT id="39"><B>-rkey file</B><DD>
|
|
|
|
|
|
The private key to sign <FONT SIZE="-1">OCSP</FONT> responses with: if not present the file
|
|
specified in the <B>rsigner</B> option is used.
|
|
<DT id="40"><B>-rsigopt nm:v</B><DD>
|
|
|
|
|
|
Pass options to the signature algorithm when signing <FONT SIZE="-1">OCSP</FONT> responses.
|
|
Names and values of these options are algorithm-specific.
|
|
<DT id="41"><B>-port portnum</B><DD>
|
|
|
|
|
|
Port to listen for <FONT SIZE="-1">OCSP</FONT> requests on. The port may also be specified
|
|
using the <B>url</B> option.
|
|
<DT id="42"><B>-ignore_err</B><DD>
|
|
|
|
|
|
Ignore malformed requests or responses: When acting as an <FONT SIZE="-1">OCSP</FONT> client, retry if
|
|
a malformed response is received. When acting as an <FONT SIZE="-1">OCSP</FONT> responder, continue
|
|
running instead of terminating upon receiving a malformed request.
|
|
<DT id="43"><B>-nrequest number</B><DD>
|
|
|
|
|
|
The <FONT SIZE="-1">OCSP</FONT> server will exit after receiving <B>number</B> requests, default unlimited.
|
|
<DT id="44"><B>-nmin minutes</B>, <B>-ndays days</B><DD>
|
|
|
|
|
|
Number of minutes or days when fresh revocation information is available:
|
|
used in the <B>nextUpdate</B> field. If neither option is present then the
|
|
<B>nextUpdate</B> field is omitted meaning fresh revocation information is
|
|
immediately available.
|
|
</DL>
|
|
<A NAME="lbAH"> </A>
|
|
<H2>OCSP Response verification.</H2>
|
|
|
|
|
|
|
|
<FONT SIZE="-1">OCSP</FONT> Response follows the rules specified in <FONT SIZE="-1">RFC2560.</FONT>
|
|
<P>
|
|
|
|
Initially the <FONT SIZE="-1">OCSP</FONT> responder certificate is located and the signature on
|
|
the <FONT SIZE="-1">OCSP</FONT> request checked using the responder certificate's public key.
|
|
<P>
|
|
|
|
Then a normal certificate verify is performed on the <FONT SIZE="-1">OCSP</FONT> responder certificate
|
|
building up a certificate chain in the process. The locations of the trusted
|
|
certificates used to build the chain can be specified by the <B>CAfile</B>
|
|
and <B>CApath</B> options or they will be looked for in the standard OpenSSL
|
|
certificates directory.
|
|
<P>
|
|
|
|
If the initial verify fails then the <FONT SIZE="-1">OCSP</FONT> verify process halts with an
|
|
error.
|
|
<P>
|
|
|
|
Otherwise the issuing <FONT SIZE="-1">CA</FONT> certificate in the request is compared to the <FONT SIZE="-1">OCSP</FONT>
|
|
responder certificate: if there is a match then the <FONT SIZE="-1">OCSP</FONT> verify succeeds.
|
|
<P>
|
|
|
|
Otherwise the <FONT SIZE="-1">OCSP</FONT> responder certificate's <FONT SIZE="-1">CA</FONT> is checked against the issuing
|
|
<FONT SIZE="-1">CA</FONT> certificate in the request. If there is a match and the OCSPSigning
|
|
extended key usage is present in the <FONT SIZE="-1">OCSP</FONT> responder certificate then the
|
|
<FONT SIZE="-1">OCSP</FONT> verify succeeds.
|
|
<P>
|
|
|
|
Otherwise, if <B>-no_explicit</B> is <B>not</B> set the root <FONT SIZE="-1">CA</FONT> of the <FONT SIZE="-1">OCSP</FONT> responders
|
|
<FONT SIZE="-1">CA</FONT> is checked to see if it is trusted for <FONT SIZE="-1">OCSP</FONT> signing. If it is the <FONT SIZE="-1">OCSP</FONT>
|
|
verify succeeds.
|
|
<P>
|
|
|
|
If none of these checks is successful then the <FONT SIZE="-1">OCSP</FONT> verify fails.
|
|
<P>
|
|
|
|
What this effectively means if that if the <FONT SIZE="-1">OCSP</FONT> responder certificate is
|
|
authorised directly by the <FONT SIZE="-1">CA</FONT> it is issuing revocation information about
|
|
(and it is correctly configured) then verification will succeed.
|
|
<P>
|
|
|
|
If the <FONT SIZE="-1">OCSP</FONT> responder is a ``global responder'' which can give details about
|
|
multiple CAs and has its own separate certificate chain then its root
|
|
<FONT SIZE="-1">CA</FONT> can be trusted for <FONT SIZE="-1">OCSP</FONT> signing. For example:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl x509 -in ocspCA.pem -addtrust OCSPSigning -out trustedCA.pem
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Alternatively the responder certificate itself can be explicitly trusted
|
|
with the <B>-VAfile</B> option.
|
|
<A NAME="lbAI"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
|
|
|
|
As noted, most of the verify options are for testing or debugging purposes.
|
|
Normally only the <B>-CApath</B>, <B>-CAfile</B> and (if the responder is a 'global
|
|
<FONT SIZE="-1">VA</FONT>') <B>-VAfile</B> options need to be used.
|
|
<P>
|
|
|
|
The <FONT SIZE="-1">OCSP</FONT> server is only useful for test and demonstration purposes: it is
|
|
not really usable as a full <FONT SIZE="-1">OCSP</FONT> responder. It contains only a very
|
|
simple <FONT SIZE="-1">HTTP</FONT> request handling and can only handle the <FONT SIZE="-1">POST</FONT> form of <FONT SIZE="-1">OCSP</FONT>
|
|
queries. It also handles requests serially meaning it cannot respond to
|
|
new requests until it has processed the current one. The text index file
|
|
format of revocation is also inefficient for large quantities of revocation
|
|
data.
|
|
<P>
|
|
|
|
It is possible to run the <B>ocsp</B> application in responder mode via a <FONT SIZE="-1">CGI</FONT>
|
|
script using the <B>reqin</B> and <B>respout</B> options.
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
|
|
|
|
Create an <FONT SIZE="-1">OCSP</FONT> request and write it to a file:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem -reqout req.der
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Send a query to an <FONT SIZE="-1">OCSP</FONT> responder with <FONT SIZE="-1">URL</FONT> <A HREF="http://ocsp.myhost.com/">http://ocsp.myhost.com/</A> save the
|
|
response to a file, print it out in text form, and verify the response:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ocsp -issuer issuer.pem -cert c1.pem -cert c2.pem \
|
|
-url <A HREF="http://ocsp.myhost.com/">http://ocsp.myhost.com/</A> -resp_text -respout resp.der
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Read in an <FONT SIZE="-1">OCSP</FONT> response and print out text form:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ocsp -respin resp.der -text -noverify
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
<FONT SIZE="-1">OCSP</FONT> server on port 8888 using a standard <B>ca</B> configuration, and a separate
|
|
responder certificate. All requests and responses are printed to a file.
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
|
|
-text -out log.txt
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
As above but exit after processing one request:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ocsp -index demoCA/index.txt -port 8888 -rsigner rcert.pem -CA demoCA/cacert.pem
|
|
-nrequest 1
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Query status information using an internally generated request:
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
|
|
-issuer demoCA/cacert.pem -serial 1
|
|
|
|
</PRE>
|
|
|
|
|
|
<P>
|
|
|
|
Query status information using request read from a file, and write the response
|
|
to a second file.
|
|
<P>
|
|
|
|
|
|
|
|
<PRE>
|
|
openssl ocsp -index demoCA/index.txt -rsigner rcert.pem -CA demoCA/cacert.pem
|
|
-reqin req.der -respout resp.der
|
|
|
|
</PRE>
|
|
|
|
|
|
<A NAME="lbAK"> </A>
|
|
<H2>HISTORY</H2>
|
|
|
|
|
|
|
|
The -no_alt_chains option was added in OpenSSL 1.1.0.
|
|
<A NAME="lbAL"> </A>
|
|
<H2>COPYRIGHT</H2>
|
|
|
|
|
|
|
|
Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
|
|
<P>
|
|
|
|
Licensed under the OpenSSL license (the ``License''). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file <FONT SIZE="-1">LICENSE</FONT> in the source distribution or at
|
|
<<A HREF="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</A>>.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="45"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="46"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="47"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="48"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DL>
|
|
<DT id="49"><A HREF="#lbAF"><FONT SIZE="-1">OCSP</FONT> Client Options</A><DD>
|
|
<DT id="50"><A HREF="#lbAG"><FONT SIZE="-1">OCSP</FONT> Server Options</A><DD>
|
|
</DL>
|
|
<DT id="51"><A HREF="#lbAH">OCSP Response verification.</A><DD>
|
|
<DT id="52"><A HREF="#lbAI">NOTES</A><DD>
|
|
<DT id="53"><A HREF="#lbAJ">EXAMPLES</A><DD>
|
|
<DT id="54"><A HREF="#lbAK">HISTORY</A><DD>
|
|
<DT id="55"><A HREF="#lbAL">COPYRIGHT</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:20 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|