Fix OCSP response handling errors with Let's Encrypt #4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Apxs adds flags from the Apache build it is from, and those might not work in some cases, for example if a different compiler was used.
Some CAs (notably Let's Encrypt) support only SHA1. Support for that is required by RFC 5019 [1] and referenced in CAB Forum Baseline Requirements, too. This particular hash doesn't need to be cryptographically secure, so switching to SHA1 is the simplest solution. [1] https://datatracker.ietf.org/doc/html/rfc5019#section-2.1.1
|
I've tried the fix against mod_gnutls-0.11 and installed the new mod_gnutls.so but I'm still getting an error and an warning. File: ssl_error File tnonline.net-access_log File: vhost.conf File: options-ssl-apache.conf File: 47_mod_gnutls.conf Is there something else i am missing? I thought that |
That setting is optional as long as your certificate contains the responder URL. The warning that mentions it is about an intermediate CA higher up the chain, and basically means mod_gnutls won't be able to staple an OCSP response for that CA certificate. It should still work for the server. It's hard for me to guess what other constraints the Let's Encrypt responder might enforce. I wonder if there is any error message in the HTTP response? It's not logged currently, but you should be able to see it in a packet capture, or I could give you a patch that logs it (which I wouldn't want to do in production). I'll try to go through RFC 5019 to see if there are other MUSTs that mod_gnutls should implement, but that won't tell me what Let's Encrypt actually enforces. |
The response is BAD REQUEST. I think it is missing a mod_gnutls HTTP request OpenSSL HTTP request mod_gnutls full packet dump: requestmod_gnutls full packet dump: responseOpenSSL full packet dump: requestOpenSSL full packet dump: response |
|
Thank you, that's an important clue! Could you test the additional patch in b8e9e11, please? |
This works. I am now getting a correct response. :) wireshark-packet-dump requestresponsessl_error_log tnonline.net-error_log I've tried the following three GnuTLSCache settings: |
|
Do the different logs refer to different virtual hosts? I wonder if those failures might be for different certificates. Either way it'd be good to turn up the log level at least to debug, trace1 or trace2 would give some extra info on cache operations. The messages in Do you get a stapled OCSP response when connecting to your server now? |
Of course. Fixed that!
Not in this case. I do run tnonline.net with a different certificate than mirrors.tnonline.net. (I don't use wildcards). The error logs are identical on both vhosts. I'll add debug logging in apache. Is there a specific debug log setting for mod_gnutls? I double checked and they are using
No. Can also be checked with https://www.ssllabs.com/ssltest/analyze.html?d=tnonline.net&s=81.170.131.138&hideResults=on&latest |
Mod_gnutls uses the Apache log facilities, so you can just use the |
Great! Thank you. I can see that we are indeed getting an OSCP response, though I am not sure how to correctly interpret the results. I connectec from local terminal with I'm available on #mod_gnutls over at irc.libera.chat and irc.indymedia.org if you think it would be better to continue on IRC. tnonline.net-error_log ssl-error_log |
|
This is where things go wrong: The relevant code is this: Lines 326 to 339 in b8e9e11 The last line in that block logs the error message based on the value written to This seems to be where things goes wrong: https://gitlab.com/gnutls/gnutls/-/blob/c70941cea73cb38e0d27395e63aafca12dac9a72/lib/x509/ocsp.c#L2380-2386 The way I understand RFC 6960, section 4.2.2.2 the |
I am very grateful you helped out so much. I do not know the details of the RFC. Perhaps you can talk to GnuTLS devs about it? |
I intend to. I have a half-finished finished reproducer and an idea for a fix, which I'll be able to test when the reproducer is done. 🙂 I'll probably merge this after creating the issue, and I'll definitely leave a link here. |
The detour over a trust list is unnecessary by using gnutls_ocsp_resp_verify_direct(), which simplifies the code a lot, and also avoids a current bug in gnutls_ocsp_resp_verify() [1]. [1] https://gitlab.com/gnutls/gnutls/-/issues/1254
|
While looking at fixing @Forza-tng, could you check if this solves the errors you're seeing? One additional note: I see in the logs you've configured a dbm cache. Last time I tried that mod_socache_dbm enforced a size limit for values that was too small for the OCSP responses I was working with. If that affects you, try using shmcb instead. The GnuTLS bug report regarding |
airtower-luna
changed the title
Hi again. Sorry for the late reply. I was travelling. OSCP stapling does work now. I can see requests being made, verified and stored in schmcb cache. :) When I use This is the output in ssl_error_log when doing curl -i https://tnonline.net:443 |
|
Hm, the log looks like mod_gnutls gets a response from the OCSP responder now, but then discards it because the nonce is invalid. The Let's Encrypt responder doesn't support the nonce extension, so that check fails. Did you enable |
I didn't have |
|
That leaves me extremely confused. Assuming you're running the current code from this Git repository, there should be no way that code runs with Lines 329 to 337 in 5168eb0 Also in my local test environment an OCSP response without a nonce is accepted just fine. |
|
In case anyone else finds this later, #5 has the fix for the secondary problem. 🙂 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
/if the OCSP URI doesn't provide a path.gnutls_ocsp_resp_verify_direct()to verify OCSP responses, sidestepping the complexity of trust lists.Fixes #3.