pogpp/lego
1
0
Fork 0
forked from TrueCloudLab/lego
Code Pull requests Activity

Make ocsp validate the signature of a response.

Browse source 
OCSP signatures should get validated if no issuer certificate is returned from
the OCSP responder.
This commit is contained in:
xenolf 2015-10-27 22:31:56 +01:00
parent f2f5117496
commit 65b62b5670
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
acme/crypto.go
View file

@ -14,7 +14,6 @@ import (
"errors"
"fmt"
"io/ioutil"
"log"
"math/big"
"net/http"
"time"
@ -84,12 +83,18 @@ func GetOCSPForCert(bundle []byte) ([]byte, error) {
}
ocspResBytes, err := ioutil.ReadAll(req.Body)
_, err = ocsp.ParseResponse(ocspResBytes, nil)
ocspRes, err := ocsp.ParseResponse(ocspResBytes, issuerCert)
if err != nil {
log.Printf("OCSPParse Error: %v", err)
return nil, err
}
if ocspRes.Certificate == nil {
err = ocspRes.CheckSignatureFrom(issuerCert)
if err != nil {
return nil, err
}
}
return ocspResBytes, nil
}