maddy
maddy copied to clipboard
foxcpp
Add OCSP stapling for both client and server
Use case
Introduce an OCSP stapling system so that Maddy can check the certificates of servers it's connecting to, but also send an OCSP reponse of the certificate the mail server is currently using when an e-mail is being received.
That would be a killer feature and Maddy would be the "second" known mail server to have such a feature!
Your idea for a solution
I have no idea for a solution as I am not good enough with the Go language to provide anything worthful.
- [ ] I'm willing to help with the implementation
For client, we would need to have an OCSP verifier which does not seem to be available in the standard library or x/crypto: https://github.com/golang/go/issues/40017 And there does not seem to be a reasonably complete verification implementation on GitHub.
Once one is available - it should be trivial to plug it into maddy and have OCSP verification working.
As for stapling OCSP responses on server side, this is something we could probably work on. Need to study how caddy does it and see if we can share any code.
I wonder if we can tear out our TLS management code and replace it with certmagic (https://github.com/caddyserver/certmagic) that also seems to implement OCSP stapling in addition to ACME (thus we will also solve #3).
Otherwise the code to steal is https://github.com/caddyserver/certmagic/blob/eba05a818ed35af0d015b6799486afff704ffa28/ocsp.go#L31
While I believe it is unfeasible for us to fully replace our TLS management code with Certmagic, I believe we can integrate it into tls.loader.file good enough so it could handle OCSP stapling for us. I will experiment with it while implementing #3.
tls.loader.acme introduced by 93cf4f231a4e23ea7d6fef642024b027b39e995c supports OCSP stapling.
That's amazing! You managed to implement a feature like that in no time, that's amazing!
I got a question though, does OCSP stapling works when using certificates generated by an external software (eg: acme.sh)?
Yeah. That's the problem. It works only for certificates automatically obtained using built-in ACME client now.