Hi,

I have attached a PDF which should help explain wolfSSL's OCSP Stapling functionality.  Are you able to share any details of the project you are working on?

Thanks,
Chris

Hi,

Thanks for the additional details.  It looks like my attachment didn't work correctly last time.  Trying again here.

Thanks,
Chris

I'd like to access the ocsp response and extract the thisUpdate, nextUpdate, etc fields for data collection.

OK. so I used wireshark to find out that the bing.com server does not understand status_request_v2. It only understands status_request (i.e., regular ocsp stapling), so I recompiled with --enable-ocsp stapling, and I updated my code to:

            if((use_ocsp = wolfSSL_UseOCSPStapling(ssl, WOLFSSL_CSR2_OCSP, 0)) != SSL_SUCCESS)
              logsslerror(use_ocsp, "OCSP Error");

            if((use_ocsp = wolfSSL_CTX_EnableOCSPStapling(ctx)) != SSL_SUCCESS)
              logsslerror(use_ocsp, "CTX_EnableOCSP error");

            if((use_ocsp = wolfSSL_SetOCSP_Cb(ssl, ocspCb, NULL, NULL)) != SSL_SUCCESS)
              logsslerror(use_ocsp, "OCSP CB Error");

Now based on wireshark, I can see the OCSP response in the Server Hello, but my callback is still not getting called.

Hi,

The OCSP callback (registered with wolfSSL_CTX_SetOCSP_Cb()) is meant to allow your application to have control over connecting to the OCSP Responder and parsing/verifying the response.  wolfSSL uses an internal OCSP callback (EmbedOcspLookup() in ./src/io.c) to do this by default, but when you override our internal callback with wolSSL_CTX_SetOCSP_Cb(), your application needs to handle this yourself within your callback.  Your callback should return 0 on success or -1 on error.

One option that would allow you to inspect the OCSP response would be to:

1.  Write and register your own OCSP callback with wolSSL_CTX_SetOCSP_Cb()
2.  Have your callback just call our default callback (EmbedOcspLookup()).  This is a public API function exposed through <wolfssl/ssl.h>
3.  After our internal callback returns, you should be able to look at the response data inside the "unsigned char** resp" output variable.

Best Regards,
Chris

The CB is not getting called. This is what I have:

int ocspCb(void *a, const char* url, int urlSz, unsigned char *req, int reqSz, unsigned char **resp)
{
  int retVal = EmbedOcspLookup(a, url, urlSz, req, reqSz, resp);
  printf("resp: %s\n", *resp);

  return retVal;
}

void ocspRespFree(void *a, unsigned char *b)
{
  EmbedOcspRespFree(a, b);
}

if((use_ocsp = wolfSSL_CTX_UseOCSPStapling(ctx, WOLFSSL_CSR_OCSP, 0)) != SSL_SUCCESS)
              logsslerror(use_ocsp, "OCSP Error");

            if((use_ocsp = wolfSSL_CTX_EnableOCSP(ctx, 0)) != SSL_SUCCESS)
              logsslerror(use_ocsp, "CTX_EnableOCSP error");

            if((use_ocsp = wolfSSL_CTX_EnableOCSPStapling(ctx)) != SSL_SUCCESS)
              logsslerror(use_ocsp, "CTX_EnableOCSPStapling error");

            if((use_ocsp = wolfSSL_CTX_SetOCSP_Cb(ctx, ocspCb, ocspRespFree, NULL)) != SSL_SUCCESS)
              logsslerror(use_ocsp, "OCSP CB Error");

            if (wolfSSL_connect_ex(ssl, handShakeCB, timeoutCB, timeout) == SSL_SUCCESS)
            {
              printf("%s\n", "SSL handshake complete");
              processServerRandom(ssl);
            }
            else {
              int err2 = wolfSSL_get_error(ssl, 0);
              logsslerror(err2, "SSL handshake error");
            }

why does this not work? the last void* param seems to not be used in any function, so I'm confusued about what;s going wrong.

Updates. After debugging the code, I've boiled it down to CertStatus.thisDate and .nextDate

I edited code in wolfcrypt/src/asn.c (DecodeSingleResponse) and I was able to dump the thisDate and nextDate buffers. But how do I access this stuff from a normal program using the wolfSSL API? Is this supported or not?