On Friday 11 August 2017 03:31:27 lists+b...@ggp2.com wrote:
> >Synopsis:      httpd incorrectly handles OCSP stapling 
> >Category:      system
> 
> >Environment:
>         System      : OpenBSD 6.1
>         Details     : OpenBSD 6.1 (GENERIC.MP) #19: Thu Aug  3 14:59:44 CEST
> 2017
> rob...@syspatch-61-amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERI
> C.MP
> 
>         Architecture: OpenBSD.amd64
>         Machine     : amd64
> 
> >Description:
>     I run multiple domains on an httpd instance.  When I tried to enable
> OCSP stapling for several domains, only the first defined domain would work
> properly.  Regardless of whether I had defined an OCSP block or not for
> subsequent domains after the first, I'm suspecting that the OCSP response
> stapled to the first domain is used for all the others.  Firefox refuses to
> connect to any but the first defined domains, and gives an OCSP error.
> 
>     (also apologies if this is a repost, I didn't have the alias set up
> yet,  and believe the majordomo "confirm" mail went to /dev/null)
> 
> >How-To-Repeat:
>     Get OCSP responses:
>     
>     ocspcheck -N -o /etc/ssl/acme/domain1.com.der
> /etc/ssl/acme/domain1.com.fullchain.pem ocspcheck -N -o
> /etc/ssl/acme/domain2.com.der /etc/ssl/acme/domain2.com.fullchain.pem 
>     Define multiple server{} blocks in httpd.conf, and give each an ocsp
> defintion: 
>     server "domain1.com" {
>         listen on $ext_addr tls port 443
>     
>         tls {
>             certificate "/etc/ssl/acme/domain1.com.fullchain.pem"
>             key "/etc/ssl/acme/private/domain1.com.key"
>             ocsp "/etc/ssl/acme/domain1.com.der"
>         }
>     }
>     
>     server "domain2.com" {
>         listen on $ext_addr tls port 443
>     
>         tls {
>             certificate "/etc/ssl/acme/domain2.com.fullchain.pem"
>             key "/etc/ssl/acme/private/domain2.com.key"
>             ocsp "/etc/ssl/acme/domain2.com.der"
>         }
>     }
>     
>     Try to visit domain2.com.  Whether or not domain2 has the ocsp
> definition is irrelevant; Firefox fails to access the domain with an OCSP
> error.  domain1.com works fine in either case.
> 
> >Fix:
>     Fix is unknown, but would involve OCSP stapling being handled properly
> for multiple domains.  It could be SNI related.

This should already be fixed in -current.

Reply via email to