On 29/05/13 11:15, Christian Stroehmeier wrote:
thanks for your elaborate answer. I forwarded this to our certificate
guys and they came up with a simple idea of a patch. I did some fixing
so it would actually compile, and now it works for me. I am not really
familiar with your workflow regarding patches, so I figured I just
attach it here :)
Thanks for the patch. It's not production-ready (it has a memory leak
and it masks genuine OCSP errors) but it was enough to push me into
writing a proper fix:
http://git.ipxe.org/ipxe.git/commitdiff/0036fdd
I have tested this against your web server on
https://groups.uni-paderborn.de/, and it does work.
I have not been able to test the code path for responder certificates
identified by public key hash (rather than by name), since there seems
to be no way to configure the OpenCA OCSP responder to use this form of
responder ID.
Incidentally, your web server is providing a certificate chain which
includes the CA root certificate ("Deutsche Telekom Root CA 2"). Web
servers usually do not provide the CA root certificate as part of their
certificate chain.
If you omit the CA root certificate from the web server's certificate
chain, then iPXE will be able to obtain it automatically using the
cross-signing mechanism, and you will no longer need to use a custom
iPXE compiled with TRUST=deutsche-telekom-root-ca-2.crt. Other browsers
will not be affected. I would recommend that you do this.
Michael
_______________________________________________
ipxe-devel mailing list
[email protected]
https://lists.ipxe.org/mailman/listinfo.cgi/ipxe-devel
