On Thu, Jan 08, 2015 at 12:08:24PM +0100, Alessandro Ghedini wrote: > Here I am again :) > > The only difference from [0] is that I fixed the NSS patch to shorten the line > longer than 79 chars like Kamil suggested. I also fixed some typos in the > commit > messages. > > Unfortunately I haven't had much time to look into the OpenSSL problem yet. > For > those interested my current patch is at [1] (in the status_request_openssl > branch). > > I'm including my original mail below, for context: > > > I attached the patches that implement OCSP stapling for both GnuTLS and NSS > > backends, and the --cert-status option for curl. They also include > > documentation > > for both the libcurl and curl options. > > > > So, the GnuTLS and NSS backends are, AFAICT, fully functional. The failures > > I > > was seeing in the GnuTLS backend were caused by a bug in GnuTLS itself, > > which > > got fixed in the 3.3.11 release. You may still see failures due to a bug in > > libtasn1 (used by GnuTLS), which got fixed in the 4.2 release (for reference > > see [0] and [1]). > > > > As for the OpenSSL (which I left out for now) backend, I'm pretty sure > > OpenSSL's > > OCSP support is broken, since it requires the issuer certificate to be in > > the > > trust store (which basically means that e.g. an intermediate certificate > > needs > > to be in the store, even if it's itself signed by a CA certificate). > > Notably, > > this breaks pretty much all CloudFlare sites (or any sites that use > > intermediate > > certificates) unless those issuers are trusted with --capath/--cacert. I > > haven't > > looked into this yet, but I'll probably file a bug report at some point, and > > finish up the curl support if/when this gets fixed. > > > > Even without OpenSSL support (which can be added later on), I think this is > > ready to be merged. For testing, you can use the following websites that > > support > > OCSP stapling: > > > > https://yahoo.com > > https://mozilla.org > > https://tn123.org > > https://digitalocean.com (from CloudFlare) > > https://kuix.de:5148 > > https://kuix.de:5149 (this got its certificate revoked, so the check must > > fail) > > > > [0] https://bugs.debian.org/772055 > > [1] https://bugs.debian.org/759161 > > Cheers > > [0] http://curl.haxx.se/mail/lib-2014-12/0107.html > [1] https://github.com/ghedo/curl/tree/status_request_openssl
Ping? Cheers
signature.asc
Description: Digital signature
------------------------------------------------------------------- List admin: http://cool.haxx.se/list/listinfo/curl-library Etiquette: http://curl.haxx.se/mail/etiquette.html
