Client-side OCSP does not work with TLS 1.3

Open stolyarchukav opened this issue 2 years ago • 0 comments

Hello, I've discovered that OCSP was not implemented for TLS 1.3. org.bouncycastle.tls.TlsClientProtocol#certificateStatus variable can be set by org.bouncycastle.tls.TlsClientProtocol#handleHandshakeMessage method but not by org.bouncycastle.tls.TlsClientProtocol#handle13HandshakeMessage method. Therefore, org.bouncycastle.jsse.provider.TransportData#getStatusResponses() is always empty when TLS 1.3 is used.

The change where OCSP client-side stapling had been added https://github.com/bcgit/bc-java/commit/f1914b60d4d7f5714a81109cfc5499dd11813a2a#diff-4653baa30eab4aed3156cd465f7fb1248aee4b1cde543c0e30ace4eed397ebf7

Versions:

group: 'org.bouncycastle', name: 'bc-fips-debug', version: '1.0.2.3'
group: 'org.bouncycastle', name: 'bctls-fips', version: '1.0.17'

Thank you

Sep 07 '23 16:09 stolyarchukav