lua-nginx-module icon indicating copy to clipboard operation
lua-nginx-module copied to clipboard

validate and expose nextUpdate field in OCSP response

Open ElvinEfendi opened this issue 4 years ago • 2 comments

I hereby granted the copyright of the changes in this pull request to the authors of this lua-nginx-module project.

Required by https://github.com/openresty/lua-resty-core/pull/296

This is an alternative solution to https://github.com/openresty/lua-nginx-module/pull/1041. I like the approach in this PR better because it adds minimal amount of code and it makes sense for validation API to return this data.

The code has been fork lifted from Nginx source and adjusted here.

In addition to exposing nextUpdate field, this way we will also be validating nextUpdate field.

ElvinEfendi avatar Apr 18 '20 06:04 ElvinEfendi

For tests see https://github.com/openresty/lua-resty-core/pull/296#issuecomment-615883139

ElvinEfendi avatar Apr 18 '20 20:04 ElvinEfendi

@ElvinEfendi I would like to merge this PR. But I found the t/ocsp.t TEST 19 can not pass. got the following error other than that in the test case. Would you please help add some doc about how to generate the revoke ocsp.

2022/01/08 13:54:59 [error] 589#0: *8 [lua] ssl_certificate_by_lua:22: failed to validate OCSP response: certificate status not found in the OCSP response. next_update: nil, context: ssl_certificate_by_lua*, client: unix:, server: unix:/home/ljl/code/openresty/lua-resty-core/t/servroot/html/nginx.sock

zhuizhuhaomeng avatar Jan 08 '22 05:01 zhuizhuhaomeng