使用 Verisign OCSP 服务器验证证书

发布于 2024-10-12 14:43:50 字数 693 浏览 8 评论 0原文

我正在尝试使用 Verisign 的 OCSP 服务器来验证它已颁发的证书，例如，

我有 amazon.com 颁发者证书（很难找到）。以及amazon 0证书。我正在使用 openSSL，但我似乎无法获得正确的 OCSP 响应者证书来验证响应。

openssl ocsp -issuer test4-May2009Oc2010.cer -CAfile veri-ssp-intermediate-ca.crt -nonce -cert amazon0.crt -url http://ocsp.verisign.com

这就是响应：

WARNING: no nonce in response
Response Verify Failure
140735084268796:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:122:Verify error:unable to get local issuer certificate
amazon0.crt: good
    This Update: Jan 19 00:24:56 2011 GMT
    Next Update: Jan 26 00:24:56 2011 GMT

关于 OCSP 响应器的正确证书实际上可能在哪里有什么建议吗？

原文

I'm attempting to use Verisign's OCSP server to verify a certificate that it has issued, for example, amazon.com

I have the issuer certificate (which was rather hard to find). As well as the amazon 0 certificate. I'm using openSSL but I don't seem to be able to get the right OCSP responder certificate to verify the response.

openssl ocsp -issuer test4-May2009Oc2010.cer -CAfile veri-ssp-intermediate-ca.crt -nonce -cert amazon0.crt -url http://ocsp.verisign.com

And this is the response:

WARNING: no nonce in response
Response Verify Failure
140735084268796:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:122:Verify error:unable to get local issuer certificate
amazon0.crt: good
    This Update: Jan 19 00:24:56 2011 GMT
    Next Update: Jan 26 00:24:56 2011 GMT

Any suggestions as to where the correct certificate for the OCSP responder might actually be?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

格子衫的從容 2024-10-19 14:43:50

您不需要 OCSP 响应者证书。您的 OCSP 请求成功了，您得到了答案：证书 (amazon0.crt) 良好，没有被吊销。 “响应中没有随机数”这一行是由于 VeriSign 的 OCSP 响应程序不发回随机数（由于它必须处理大量证书，VeriSign 预先签署响应，因此不能包含随机数 - 它遵循RFC 5019）。您可以使用 -no_nonce 来避免发送随机数。

为了消除“响应验证失败”错误消息，我将中间 CA 添加到我的 CA 文件中（在您的情况下，它称为 veri-ssp-intermediate-ca.crt）。这是我添加的内容：

一旦我这样做了，我得到了：

Response verify OK
0x25F5D12D5E6F0BD4EAF2A2C966F3B4CE: good
        This Update: Jan 19 00:24:56 2011 GMT
        Next Update: Jan 26 00:24:56 2011 GMT

You don't need the OCSP responder cert. Your OCSP request worked and you got back your answer: the cert (amazon0.crt) is good, not revoked. The line "no nonce in response" is due to the fact that VeriSign's OCSP responder doesn't send back nonces (due to the large volume of certs it must handle, VeriSign pre-signs the responses and therefore cannot include nonces - it adheres to RFC 5019). You can use -no_nonce to avoid sending a nonce.

To get rid of the "Response Verify Failure" error message, I added the intermediate CA to my CAfile (in your case it's called veri-ssp-intermediate-ca.crt). Here's what I added:

Once I did that, I got:

Response verify OK
0x25F5D12D5E6F0BD4EAF2A2C966F3B4CE: good
        This Update: Jan 19 00:24:56 2011 GMT
        Next Update: Jan 26 00:24:56 2011 GMT

回复收藏 0 原文

~没有更多了~