OCSP Stapling support for Kestrel

[Tratcher]

From @rsrinivasanhome on January 5, 2018 13:28

Does Kestrel Support OCSP Stapling ? I am not able to find any links on google.

Copied from original issue: aspnet/AspNetCoreModule#283

[samsosa]

No, Kestrel doesn't support OCSP Stapling but Microsoft IIS since version 8.0 use this configuration by default.

[muratg]

After chatting with @shirhatti, putting this tentatively in 3.0.0.

[muratg]

cc @blowdart

[zigszigsdk]

I assume that this was not added in 3.0.0. Any idea when we'll see it?

[Tratcher]

No, it's on the backlog. What scenarios would this unblock for you?

Do we have a design proposal for this? As a TLS feature would this require changes to SslStream?

[zigszigsdk]

It's not currently a block for anything. I was looking into a site-report from https://www.ssllabs.com/, and wanted to see if I could simply just do it. As this thread was the first proper that popped up, and still lacked an update since 3.0.0 was released, I thought it was proper to request an update - since others might also find this thread as I did.

[Tratcher]

Depends on SslStream dotnet/runtime#33377

[adityamandaleeka]

Tentatively putting this in Preview 7 since the runtime-side dependencies are nearly done. cc: @bartonjs

[bartonjs]

@adityamandaleeka For Windows the server side is something I haven't figured out. SChannel's documentation says it's on by default unless the context is set up for doing SNI... but either something's not working or I'm really good at losing race conditions in my test efforts.

For Linux it's enabled for servers using SslStream that present their certificates via SslStreamCertificateContext objects, provided that they didn't set offline:true when they built it. (Starting in preview 7, or current builds out of main).

macOS and mobile are not in scope, they get big question marks (if it worked already then it still works; if not, it doesn't)

[adityamandaleeka]

Ahh, okay. Let us know when the Windows issues are figured out (sounds like you're actively investigating that so hopefully Preview 6 or 7?).

[adityamandaleeka]

@bartonjs Any update on this?

[bartonjs]

Nope

[adityamandaleeka]

Sounds like this is now done: dotnet/runtime#33377 and there's no known work for us to do in Kestrel for this to light up.

If the TLS Server is running Windows, then SChannel is supposed to just provide OCSP stapling with no extra work on our part, and that applies to all .NET versions.

If the TLS Server is running Linux, then OCSP Stapling requires .NET 7, because we had to do work to enable it on Linux.

For all OSes it requires that the CA uses OCSP, and that the TLS Server’s network policy permits it to talk to the OCSP endpoint appropriate to the certificate.