helpGnuTLS - Support: sr #108582, "ocsptool --ask" does...


sr #108582: "ocsptool --ask" does not send URL path to the server

Submitted by:  Matt McCutchen <hashproduct>
Submitted on:  Mon 26 May 2014 02:35:56 AM UTC  
Category:  Core library Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  Nikos Mavrogiannopoulos <nmav>
Open/Closed:  Closed Operating System:  None

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 26 May 2014 03:21:47 PM UTC, comment #1: 
Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Mon 26 May 2014 02:35:56 AM UTC, original submission:  

"ocsptool --ask" does not send the path part of the URL (specified either in the certificate or in the --ask option) to the OCSP server, which causes my OCSP server to return an error.

To reproduce:

$ gnutls-cli -p 443 --print-cert </dev/null | csplit - '/BEGIN CERTIFICATE/' '/^$/' '/BEGIN CERTIFICATE/' '/^$/'
$ ocsptool --ask --load-cert=xx01 --load-issuer=xx03Connecting to OCSP server:
Resolving ''...
Connecting to ''...
ocsptool: importing response: ASN1 parser: Error in TAG.

For comparison:

$ ocsptool -q --load-cert=xx01 --load-issuer=xx03 | curl -H 'Content-Type: application/ocsp-request' --data-binary @- | ocsptool -j --load-issuer=xx03
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1679  100  1609  100    70  15262    664 --:--:-- --:--:-- --:--:-- 15323
OCSP Response Information:
Response Status: Successful
Response Type: Basic OCSP Response
Version: 1
Responder ID: C=IL,O=StartCom Ltd. (Start Commercial Limited),CN=StartCom Class 1 Server OCSP Signer
Produced At: Mon May 26 00:56:32 UTC 2014
Certificate ID:
Hash Algorithm: SHA1
Issuer Name Hash: 6568874f40750f016a3475625e1f5c93e5a26d58
Issuer Key Hash: eb4234d098b0ab9ff41b6b08f7cc642eef0e2c45
Serial Number: 10b2a0
Certificate Status: good
This Update: Mon May 26 00:56:32 UTC 2014
Next Update: Wed May 28 00:56:32 UTC 2014

To see what is happening:

$ nc -l localhost 8080

In another terminal:

$ ocsptool --ask=http://localhost:8080/foo --load-cert=xx01 --load-issuer=xx03

nc prints:


(It should be POST /foo HTTP/1.1 .)

I tested Fedora's gnutls-3.1.23-1.fc20.x86_64, but it's clear the behavior hasn't changed in head looking at HEADER_PATTERN at .

Matt McCutchen <hashproduct>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by nmav (Updated the item)
  • -email is unavailable- added by hashproduct (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-26 nmav CategoryNone => Core library
        StatusConfirmed => Done
        Open/ClosedOpen => Closed
    2014-05-26 nmav StatusNone => Confirmed
        Assigned toNone => nmav

    Back to the top

    Powered by Savane 3.7