这篇文章主要用来说明如何借助ocsp服务器来验证证书。ocsp（The Online Certificate Status Protocol）是一种验证证书状态的一种方式，也是CRL（certificate revocation list）证书吊销的一种替代方式。
与传统的CRL比较有以下特点：
- 由于相对于传统的CRL，一个ocsp响应包含的信息更少，故ocsp能够更有效利用网络和客户资源
- 用OCSP，客户无需自己解析CRL证书吊销列表，但是客户需要存储状态信息，而由于客户侧需要维护存储缓存，故导致存储信息很复杂。在实际使用中，这点带来的影响却很小，由于第三库提供的相关接口已经帮我们完成此类工作
- OCSP通过专用网络、专用证书、在特定的时间公开其服务。OCSP不强制加密，故可能带来信息泄露的风险。
此文章中用到的openssl的版本为：OpenSSL 1.0.1g 7 Apr 2014
1、获取证书用于ocsp验证
首先，我们将从一个网站上获取一个证书，这里我们用Wikipedia作为样例来进行。我们获取证书通过如下命令：
|
1 |
$ openssl s_client -connect wikipedia.org:443 2>&1 < /dev/null | sed -n '/-----BEGIN/,/-----END/p' |
过该命令可以获取wikipedia.org的客户端证书
保存这个输出到wikipedia.pem文件中
|
1 |
$ openssl s_client -connect wikipedia.org:443 2>&1 < /dev/null | sed -n '/-----BEGIN/,/-----END/p' > wikipedia.pem |
现在，检查整个证书中是否包含ocsp网址
|
1 |
$ openssl x509 -noout -ocsp_uri -in wikipedia.pem |
若执行正确则输出 http://ocsp.digicert.com ，否则你就不能通过ocsp验证这个证书
2、获取证书链
由于这个证书认证是一级一级逐层进行，故需要获得与这个证书相关的证书链。利用openssl s_client -showcerts 选项，能够查看到在该信任链上的所有相关证书
|
1 |
$ openssl s_client -connect wikipedia.org:443 -showcerts 2>&1 < /dev/null |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3 i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA -----BEGIN CERTIFICATE----- MIIGWDCCBUCgAwIBAgIQCl8RTQNbF5EX0u/UA4w/OzANBgkqhkiG9w0BAQUFADBs MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j ZSBFViBSb290IENBMB4XDTA4MDQwMjEyMDAwMFoXDTIyMDQwMzAwMDAwMFowZjEL MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTElMCMGA1UEAxMcRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug Q0EtMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9hCikQH17+NDdR CPge+yLtYb4LDXBMUGMmdRW5QYiXtvCgFbsIYOBC6AUpEIc2iihlqO8xB3RtNpcv KEZmBMcqeSZ6mdWOw21PoF6tvD2Rwll7XjZswFPPAAgyPhBkWBATaccM7pxCUQD5 BUTuJM56H+2MEb0SqPMV9Bx6MWkBG6fmXcCabH4JnudSREoQOiPkm7YDr6ictFuf 1EutkozOtREqqjcYjbTCuNhcBoz4/yO9NV7UfD5+gw6RlgWYw7If48hl66l7XaAs zPw82W3tzPpLQ4zJ1LilYRyyQLYoEt+5+F/+07LJ7z20Hkt8HEyZNp496+ynaF4d 32duXvsCAwEAAaOCAvowggL2MA4GA1UdDwEB/wQEAwIBhjCCAcYGA1UdIASCAb0w ggG5MIIBtQYLYIZIAYb9bAEDAAIwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3 LmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUH AgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQBy AHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBj AGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAg AEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQ AGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwAaQBt AGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBj AG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBl AHIAZQBuAGMAZQAuMBIGA1UdEwEB/wQIMAYBAf8CAQAwNAYIKwYBBQUHAQEEKDAm MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgY8GA1UdHwSB hzCBhDBAoD6gPIY6aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGln aEFzc3VyYW5jZUVWUm9vdENBLmNybDBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNl cnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDAfBgNVHSME GDAWgBSxPsNpA/i/RwHUmCYaCALvY2QrwzAdBgNVHQ4EFgQUUOpzidsp+xCPnuUB INTeeZlIg/cwDQYJKoZIhvcNAQEFBQADggEBAB7ipUiebNtTOA/vphoqrOIDQ+2a vD6OdRvw/S4iWawTwGHi5/rpmc2HCXVUKL9GYNy+USyS8xuRfDEIcOI3ucFbqL2j CwD7GhX9A61YasXHJJlIR0YxHpLvtF9ONMeQvzHB+LGEhtCcAarfilYGzjrpDq6X dF3XcZpCdF/ejUN83ulV7WkAywXgemFhM9EZTfkI7qA5xSU1tyvED7Ld8aW3DiTE JiiNeXf1L/BXunwH1OH8zVowV36GEEfdMR/X/KLCvzB8XSSq6PmuX2p0ws5rs0bY Ib4p1I5eFdZCSucyb6Sxa1GDWL4/bcf72gMhy2oWGU4K8K2Eyl2Us1p292E= -----END CERTIFICATE----- |
如你所见，输出能够看到两个证书，number 1 和number 0，其中number 0就是我们刚刚获取的那个证书。如果你的网站有更多证书在认证链中，那么你将看到更多证书。为了发送证书，需要保存证书链中所有证书到一个文件chain.pem，按照刚刚命令输出的证书顺序，根证书总是在文件结尾。
3、发送ocsp认证请求
现在我们有ocsp认证请求的所有信息，使用下面命令发送ocsp认证请求。
|
1 |
$ openssl ocsp -issuer chain.pem -cert wikipedia.pem -text -url http://ocsp.digicert.com |
其结果如下
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
OCSP Request Data: Version: 1 (0x0) Requestor List: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: ED48ADDDCB7B00E20E842AA9B409F1AC3034CF96 Issuer Key Hash: 50EA7389DB29FB108F9EE50120D4DE79994883F7 Serial Number: 0114195F66FAFF8FD66E12496E516F4F Request Extensions: OCSP Nonce: 0410DA634F2ADC31DC48AE89BE64E8252D12 OCSP Response Data: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Version: 1 (0x0) Responder Id: 50EA7389DB29FB108F9EE50120D4DE79994883F7 Produced At: Apr 9 08:45:00 2014 GMT Responses: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: ED48ADDDCB7B00E20E842AA9B409F1AC3034CF96 Issuer Key Hash: 50EA7389DB29FB108F9EE50120D4DE79994883F7 Serial Number: 0114195F66FAFF8FD66E12496E516F4F Cert Status: good This Update: Apr 9 08:45:00 2014 GMT Next Update: Apr 16 09:00:00 2014 GMT Signature Algorithm: sha1WithRSAEncryption 56:21:4c:dc:84:21:f7:a8:ac:a7:b9:bc:10:19:f8:19:f1:34: c1:63:ca:14:7f:8f:5a:85:2a:cc:02:b0:f8:b5:05:4a:0f:28: 50:2a:4a:4d:04:01:b5:05:ef:a5:88:41:d8:9d:38:00:7d:76: 1a:aa:ff:21:50:68:90:d2:0c:93:85:49:e7:8e:f1:58:08:77: a0:4e:e2:22:98:01:b7:e3:27:75:11:f5:b7:8f:e0:75:7d:19: 9b:74:cf:05:dc:ae:1c:36:09:95:b6:08:bc:e7:3f:ea:a2:e3: ae:d7:8f:c0:9d:8e:c2:37:67:c7:5b:d8:b0:67:23:f1:51:53: 26:c2:96:b0:1a:df:4e:fb:4e:e3:da:a3:98:26:59:a8:d7:17: 69:87:a3:68:47:08:92:d0:37:04:6b:49:9a:96:9d:9c:b1:e8: cb:dc:68:7b:4a:4d:cb:08:f7:92:67:41:99:b6:54:56:80:0c: 18:a7:24:53:ac:c6:da:1f:4d:f4:3c:7d:68:44:1d:a4:df:1d: 48:07:85:52:86:59:46:d1:35:45:1a:c7:6b:6b:92:de:24:ae: c0:97:66:54:29:7a:c6:86:a6:da:9f:06:24:dc:ac:80:66:95: e0:eb:49:fd:fb:d4:81:6a:2b:81:41:57:24:78:3b:e0:66:70: d4:2e:52:92 wikipedia.pem: good This Update: Apr 9 08:45:00 2014 GMT Next Update: Apr 16 09:00:00 2014 GMT |
如果你需要更简略的输出，去掉-text 选项，该选项一般用于调试
|
1 2 3 4 |
$ openssl ocsp -issuer chain.pem -cert wikipedia.pem -url http://ocsp.digicert.com wikipedia.pem: good This Update: Apr 9 08:45:00 2014 GMT Next Update: Apr 16 09:00:00 2014 GMT |
4、吊销证书
如果你有一个吊销的证书，你也可以测试该证书按照上述步骤，所得的响应如下：
|
1 2 3 4 5 |
Response verify OK test-revoked.pem: revoked This Update: Apr 9 03:02:45 2014 GMT Next Update: Apr 10 03:02:45 2014 GMT Revocation Time: Mar 25 15:45:55 2014 GMT |
5、其他错误
如果证书和ocsp服务不匹配，验证将错误，使用-text选项可以查看具体错误。