Skip to content

Commit 89d94db

Browse files
julek-wolfssljulek-wolfssl
committed
ocsp: address review feedback on PR 10303
- Use KEYID_SIZE for Signer key-hash comparisons since Signer.{subject,issuer}KeyHash is sized KEYID_SIZE, not OCSP_DIGEST_SIZE. - Rename subjectHash/issuerHash to subjectNameHash/issuerNameHash in CheckOcspResponder/CheckOcspResponderChain to make the name-vs-key hash distinction explicit. - Expand the Signer.issuerKeyHash field comment to clarify it is the subject key hash of the immediate issuer CA. - Add an imposter-root-ca cert (same DN as root-ca, different RSA key) for tests that need to exercise the new CertID issuerKeyHash binding.
1 parent d9ed9de commit 89d94db

10 files changed

Lines changed: 203 additions & 14 deletions

File tree

‎certs/ocsp/imposter-root-ca-cert.der‎

1.23 KB
Binary file not shown.

‎certs/ocsp/imposter-root-ca-cert.pem‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
Certificate:
2+
Data:
3+
Version: 3 (0x2)
4+
Serial Number: 199 (0xc7)
5+
Signature Algorithm: sha256WithRSAEncryption
6+
Issuer: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
7+
Validity
8+
Not Before: Apr 27 16:12:19 2026 GMT
9+
Not After : Jan 21 16:12:19 2029 GMT
10+
Subject: C = US, ST = Washington, L = Seattle, O = wolfSSL, OU = Engineering, CN = wolfSSL root CA, emailAddress = info@wolfssl.com
11+
Subject Public Key Info:
12+
Public Key Algorithm: rsaEncryption
13+
Public-Key: (2048 bit)
14+
Modulus:
15+
00:f3:c7:6e:93:4e:94:7d:9a:76:cb:3e:82:21:30:
16+
a0:a5:4a:a2:6c:80:bf:e6:a0:7d:6c:cc:aa:e6:94:
17+
f3:42:41:7f:1a:ba:5f:89:d2:84:67:81:4d:37:0b:
18+
26:ed:f8:f1:be:84:f5:33:9f:be:98:d1:88:86:c1:
19+
93:d3:8e:40:56:36:28:4f:14:c2:f7:a7:3b:ca:1d:
20+
ae:59:6b:5f:79:54:b6:2e:6e:4d:7f:4c:71:0d:fb:
21+
3a:6e:95:8f:96:44:3c:f2:91:01:cb:68:17:07:33:
22+
97:cb:32:55:47:03:64:0c:4b:16:2e:20:f8:65:c7:
23+
6a:52:e4:fd:a9:2d:de:39:0c:5f:1a:14:10:9d:c3:
24+
2d:15:c4:88:2e:19:58:e1:fd:69:12:81:d2:af:f6:
25+
62:44:b0:89:82:b5:f5:17:23:2b:73:8e:e3:55:14:
26+
43:a5:4a:7e:cb:96:62:8f:96:bf:5f:c3:82:dc:86:
27+
86:85:89:f8:8e:68:b2:ef:e5:2e:8c:b9:8d:56:13:
28+
19:65:e9:79:c5:29:dc:89:0b:dd:23:35:fe:d5:48:
29+
b6:2d:ad:ee:ee:6c:b8:3e:eb:79:1c:41:d1:b8:e5:
30+
0e:2f:2d:cf:d7:65:fa:71:6f:60:9b:90:30:43:da:
31+
c3:e2:1b:8f:da:ab:37:c5:38:88:6b:85:15:5b:24:
32+
72:bf
33+
Exponent: 65537 (0x10001)
34+
X509v3 extensions:
35+
X509v3 Basic Constraints:
36+
CA:TRUE
37+
X509v3 Subject Key Identifier:
38+
73:64:66:3E:9A:DE:12:EC:44:C2:5B:05:64:62:1D:63:23:43:55:E5
39+
X509v3 Authority Key Identifier:
40+
keyid:73:64:66:3E:9A:DE:12:EC:44:C2:5B:05:64:62:1D:63:23:43:55:E5
41+
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com
42+
serial:C7
43+
X509v3 Key Usage:
44+
Certificate Sign, CRL Sign
45+
Authority Information Access:
46+
OCSP - URI:http://127.0.0.1:22220
47+
Signature Algorithm: sha256WithRSAEncryption
48+
Signature Value:
49+
35:b1:f0:64:89:fe:7e:b3:5f:80:15:57:a0:8f:cd:fc:a0:2d:
50+
36:29:39:a3:ee:d6:c0:f3:c2:e6:31:2e:ce:9b:d4:a1:3e:dc:
51+
c7:0d:2a:ae:72:c6:fa:ee:77:d7:4b:98:c0:32:7e:d2:54:3f:
52+
41:34:09:22:f3:34:db:ff:4e:35:79:15:50:fa:e2:bd:37:1c:
53+
0e:dc:4e:b1:5a:5d:fd:be:bf:d1:75:02:9a:a8:61:da:d4:f1:
54+
35:b3:7e:9d:10:29:a8:cd:50:7c:3c:89:5e:a1:b2:51:e6:d8:
55+
4d:dd:cc:3d:b9:8e:5b:20:51:33:e0:03:57:e0:f7:5b:be:85:
56+
64:a7:8c:6d:40:56:cd:78:4f:6d:dc:04:f2:4a:f3:a1:29:3b:
57+
64:e5:db:a0:98:80:c8:6b:12:25:4c:18:40:2a:ce:b6:94:fe:
58+
58:bb:35:91:22:36:d7:29:70:53:2e:8b:be:e3:b7:08:d3:a8:
59+
66:19:ff:69:f0:c8:8f:b6:ea:21:bc:41:08:92:42:89:fd:d9:
60+
3a:9c:42:4b:c4:2e:81:4f:63:54:95:88:d9:56:66:08:dc:73:
61+
56:6a:97:5e:09:e5:fa:d2:52:3b:7f:bd:3b:1b:bb:f1:74:51:
62+
71:30:f3:ce:1c:21:75:89:97:7f:e4:38:f7:3e:66:c3:20:f3:
63+
c0:f3:38:c9
64+
-----BEGIN CERTIFICATE-----
65+
MIIE6DCCA9CgAwIBAgICAMcwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT
66+
MRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQK
67+
DAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEYMBYGA1UEAwwPd29sZlNT
68+
TCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTI2
69+
MDQyNzE2MTIxOVoXDTI5MDEyMTE2MTIxOVowgZcxCzAJBgNVBAYTAlVTMRMwEQYD
70+
VQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3b2xm
71+
U1NMMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEYMBYGA1UEAwwPd29sZlNTTCByb290
72+
IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMIIBIjANBgkqhkiG
73+
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA88duk06UfZp2yz6CITCgpUqibIC/5qB9bMyq
74+
5pTzQkF/GrpfidKEZ4FNNwsm7fjxvoT1M5++mNGIhsGT045AVjYoTxTC96c7yh2u
75+
WWtfeVS2Lm5Nf0xxDfs6bpWPlkQ88pEBy2gXBzOXyzJVRwNkDEsWLiD4ZcdqUuT9
76+
qS3eOQxfGhQQncMtFcSILhlY4f1pEoHSr/ZiRLCJgrX1FyMrc47jVRRDpUp+y5Zi
77+
j5a/X8OC3IaGhYn4jmiy7+UujLmNVhMZZel5xSnciQvdIzX+1Ui2La3u7my4Put5
78+
HEHRuOUOLy3P12X6cW9gm5AwQ9rD4huP2qs3xTiIa4UVWyRyvwIDAQABo4IBOjCC
79+
ATYwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUc2RmPpreEuxEwlsFZGIdYyNDVeUw
80+
gcUGA1UdIwSBvTCBuoAUc2RmPpreEuxEwlsFZGIdYyNDVeWhgZ2kgZowgZcxCzAJ
81+
BgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxl
82+
MRAwDgYDVQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtFbmdpbmVlcmluZzEYMBYGA1UE
83+
AwwPd29sZlNTTCByb290IENBMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wu
84+
Y29tggIAxzALBgNVHQ8EBAMCAQYwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAB
85+
hhZodHRwOi8vMTI3LjAuMC4xOjIyMjIwMA0GCSqGSIb3DQEBCwUAA4IBAQA1sfBk
86+
if5+s1+AFVegj838oC02KTmj7tbA88LmMS7Om9ShPtzHDSqucsb67nfXS5jAMn7S
87+
VD9BNAki8zTb/041eRVQ+uK9NxwO3E6xWl39vr/RdQKaqGHa1PE1s36dECmozVB8
88+
PIleobJR5thN3cw9uY5bIFEz4ANX4PdbvoVkp4xtQFbNeE9t3ATySvOhKTtk5dug
89+
mIDIaxIlTBhAKs62lP5YuzWRIjbXKXBTLou+47cI06hmGf9p8MiPtuohvEEIkkKJ
90+
/dk6nEJLxC6BT2NUlYjZVmYI3HNWapdeCeX60lI7f707G7vxdFFxMPPOHCF1iZd/
91+
5Dj3PmbDIPPA8zjJ
92+
-----END CERTIFICATE-----

‎certs/ocsp/imposter-root-ca-key.der‎

1.19 KB
Binary file not shown.

‎certs/ocsp/imposter-root-ca-key.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDzx26TTpR9mnbL
3+
PoIhMKClSqJsgL/moH1szKrmlPNCQX8aul+J0oRngU03Cybt+PG+hPUzn76Y0YiG
4+
wZPTjkBWNihPFML3pzvKHa5Za195VLYubk1/THEN+zpulY+WRDzykQHLaBcHM5fL
5+
MlVHA2QMSxYuIPhlx2pS5P2pLd45DF8aFBCdwy0VxIguGVjh/WkSgdKv9mJEsImC
6+
tfUXIytzjuNVFEOlSn7LlmKPlr9fw4LchoaFifiOaLLv5S6MuY1WExll6XnFKdyJ
7+
C90jNf7VSLYtre7ubLg+63kcQdG45Q4vLc/XZfpxb2CbkDBD2sPiG4/aqzfFOIhr
8+
hRVbJHK/AgMBAAECggEAI3Y/7hrQvALDxCYYLPbTb6gPP6RtBgITrMeLFtbVGi7H
9+
7B3vdu+SRjJHhrnPFHARzoqt1rAmvDlC2IOBWxWG42OmcnaNNBR2PJ0btzNI5K//
10+
fnqaOGnoykVhByQnio7rpMeWUL4YF3qYWr08LYPfQnCLzfMK31dmbp+UDM+402hi
11+
HSGW/EZBbVrLLjVNUta1F7FKQYx2Eq3P+Xaga58thJAoILsJItyE0iI+qK9zVWmQ
12+
xFkV99xKqpIq/IFWd86Z8QvrhZV2OdvF5uduUytfxz9Bql8dgK1dhDJvz2i3SPxV
13+
oDDwo10gG7Hi0/lk2vIwsZUDci6eNn0BDLwVudClwQKBgQD+5nde7SM5J18MLNMp
14+
EGFDLDCbcjFQoVuVRCVu1+mmO/7zC1ozwYtU+SzNmLvpvZYtUgDBlsAlP+rtsUOX
15+
ltwhTI56mCGK3TbK3HvqCLz6O4K8ty2es6uDBezQagVygOoVG4AirHLlL4FeZ/S0
16+
uvH48jWCqsdBL1NygNt4Kov9fwKBgQD01K6yGKwm6Hgvs/qtHA7kMaD0yQWelX4M
17+
SJdf/Rjq3/Nh5Cpj8Peu8KIjomnkQisFHqHnAqAiy1IGo8NbjvM/H0JOSTWy2ths
18+
l6zncle/uGXbjxqqfKecsqAOigXzJQhXtHvh+pSu5mOb+incKyAJ0ZpvAZFhcWIA
19+
1LT12LyqwQKBgG1E4psg0N6pUAdqF8McsHUZNmUMmLNV2GquYdWYXSLTyUDq9uoE
20+
5/OvNVOVS8ixavVWl9hlBU1yjwUB3lXXZ9omdVV8bbSXi+t+hOgYgtpKNIstgzLr
21+
FnT+TzwwltE1DiOqPE2g20gAC1cq/S2UjjIHsoSnLO92mDEXp/1lT8mFAoGAYEY+
22+
CASRtZ8Wm9OPUIFHDc7CN1/RGOI6NcRZ2kIhiULVZvoc/T3ld+JiL9cPAtZOKm44
23+
RioPJH+FWt0M1jUpS/oTzcsWFaXfExy1vjGFdfuh+iuU1dO86W6IaA84dbtrQ2nS
24+
iTNLQleQdeZyjYRbzeChdONN8t5uJlt+aWp4DkECgYAG5w5yilDcQedV231V1fcG
25+
IgPLkrwUVNusevAe9Jzqs6L+GwCjuR1fQ7nxfRHZOwGQNz6sMQkhVc15PI5Oer+A
26+
vbWDr93IlBjtrc6hYqMO3MwpNz2JKVF2T5+33lbS26dxhvzaXNVZdBdDtwIgCQ78
27+
CBGsRUzILXd0N1/ou7ASOg==
28+
-----END PRIVATE KEY-----

‎certs/ocsp/include.am‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ EXTRA_DIST += \
5555
certs/ocsp/root-ca-cert.pem \
5656
certs/ocsp/root-ca-cert.der \
5757
certs/ocsp/root-ca-crl.pem \
58+
certs/ocsp/imposter-root-ca-key.pem \
59+
certs/ocsp/imposter-root-ca-key.der \
60+
certs/ocsp/imposter-root-ca-cert.pem \
61+
certs/ocsp/imposter-root-ca-cert.der \
5862
certs/ocsp/test-response.der \
5963
certs/ocsp/test-response-rsapss.der \
6064
certs/ocsp/test-response-nointern.der \

‎certs/ocsp/renewcerts-for-test.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,30 @@ rm root-ca-cert.csr
6060
openssl x509 -in root-ca-cert.pem -text > tmp.pem
6161
mv tmp.pem root-ca-cert.pem
6262

63+
# imposter-root-ca: self-signed cert sharing the legitimate root-ca DN but
64+
# with a different key. Used to test that OCSP responder authorization is
65+
# bound to the CertID issuerKeyHash, not just the issuer name.
66+
openssl req \
67+
-new \
68+
-config "$WOLF_REQ_CONF" \
69+
-key imposter-root-ca-key.pem \
70+
-out imposter-root-ca-cert.csr \
71+
-subj "/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com"
72+
73+
openssl x509 \
74+
-req -in imposter-root-ca-cert.csr \
75+
-extfile $1 \
76+
-extensions v3_ca \
77+
-days 1000 \
78+
-signkey imposter-root-ca-key.pem \
79+
-set_serial 199 \
80+
-out imposter-root-ca-cert.pem \
81+
-sha256
82+
83+
rm imposter-root-ca-cert.csr
84+
openssl x509 -in imposter-root-ca-cert.pem -text > imposter-root-ca-cert_tmp.pem
85+
mv imposter-root-ca-cert_tmp.pem imposter-root-ca-cert.pem
86+
6387
update_cert intermediate1-ca "wolfSSL intermediate CA 1" root-ca v3_ca 01 $1
6488
update_cert intermediate2-ca "wolfSSL intermediate CA 2" root-ca v3_ca 02 $1
6589
update_cert intermediate3-ca "wolfSSL REVOKED intermediate CA" root-ca v3_ca 03 $1 # REVOKED

‎certs/ocsp/renewcerts.sh‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,43 @@ check_result $? ""
5454
openssl rsa -in root-ca-key.pem -outform DER -out root-ca-key.der
5555
check_result $? ""
5656

57+
# imposter-root-ca: self-signed cert sharing the legitimate root-ca DN but with
58+
# a different key. Used to test that OCSP responder authorization is bound to
59+
# the CertID issuerKeyHash, not just the issuer name.
60+
echo "OCSP renew certs imposter root step 1"
61+
openssl req \
62+
-new \
63+
-key imposter-root-ca-key.pem \
64+
-out imposter-root-ca-cert.csr \
65+
-config ../renewcerts/wolfssl.cnf \
66+
-subj "/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Engineering/CN=wolfSSL root CA/emailAddress=info@wolfssl.com"
67+
check_result $? ""
68+
69+
echo "OCSP renew certs imposter root step 2"
70+
openssl x509 \
71+
-req -in imposter-root-ca-cert.csr \
72+
-extfile openssl.cnf \
73+
-extensions v3_ca \
74+
-days 1000 \
75+
-signkey imposter-root-ca-key.pem \
76+
-set_serial 199 \
77+
-out imposter-root-ca-cert.pem
78+
check_result $? ""
79+
80+
rm imposter-root-ca-cert.csr
81+
echo "OCSP renew certs imposter root step 3"
82+
openssl x509 -in imposter-root-ca-cert.pem -text > tmp.pem
83+
check_result $? ""
84+
mv tmp.pem imposter-root-ca-cert.pem
85+
86+
echo "OCSP renew certs imposter root step 4"
87+
openssl x509 -in imposter-root-ca-cert.pem -outform DER \
88+
-out imposter-root-ca-cert.der
89+
check_result $? ""
90+
openssl rsa -in imposter-root-ca-key.pem -outform DER \
91+
-out imposter-root-ca-key.der
92+
check_result $? ""
93+
5794
# $1 cert, $2 name, $3 ca, $4 extensions, $5 serial
5895
update_cert() {
5996
echo "Updating certificate \"$1-cert.pem\""

‎src/ocsp.c‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -584,7 +584,7 @@ int CheckOcspRequest(WOLFSSL_OCSP* ocsp, OcspRequest* ocspRequest,
584584
}
585585

586586
#ifndef WOLFSSL_NO_OCSP_ISSUER_CHAIN_CHECK
587-
static int CheckOcspResponderChain(OcspEntry* single, byte* issuerHash,
587+
static int CheckOcspResponderChain(OcspEntry* single, byte* issuerNameHash,
588588
byte* issuerKeyHash, void* vp, Signer* pendingCAs) {
589589
/* Attempt to build a chain up to cert's issuer */
590590
WOLFSSL_CERT_MANAGER* cm = (WOLFSSL_CERT_MANAGER*)vp;
@@ -634,10 +634,10 @@ static int CheckOcspResponderChain(OcspEntry* single, byte* issuerHash,
634634
if (parent == NULL || parent == ca)
635635
break;
636636

637-
if (XMEMCMP(parent->subjectNameHash, issuerHash,
637+
if (XMEMCMP(parent->subjectNameHash, issuerNameHash,
638638
OCSP_DIGEST_SIZE) == 0 &&
639639
XMEMCMP(parent->subjectKeyHash, issuerKeyHash,
640-
OCSP_DIGEST_SIZE) == 0) {
640+
KEYID_SIZE) == 0) {
641641
WOLFSSL_MSG("\tOCSP Response signed by authorized "
642642
"responder delegated by issuer "
643643
"(found in chain)");
@@ -655,8 +655,8 @@ static int CheckOcspResponderChain(OcspEntry* single, byte* issuerHash,
655655
* of CertID (issuerNameHash and issuerKeyHash) must match; name-only matching
656656
* would authorize a same-DN / different-key CA. issuerKeyHash may be NULL when
657657
* unavailable, which disables the delegated branch. */
658-
int CheckOcspResponder(OcspResponse *bs, byte* subjectHash,
659-
byte* subjectKeyHash, byte extExtKeyUsage, byte* issuerHash,
658+
int CheckOcspResponder(OcspResponse *bs, byte* subjectNameHash,
659+
byte* subjectKeyHash, byte extExtKeyUsage, byte* issuerNameHash,
660660
byte* issuerKeyHash, void* vp)
661661
{
662662
int ret = 0;
@@ -672,33 +672,33 @@ int CheckOcspResponder(OcspResponse *bs, byte* subjectHash,
672672
/* In the future if this API is used more then it could be beneficial to
673673
* implement calling InitDecodedCert and ParseCertRelative here
674674
* automatically when cert == NULL. */
675-
if (bs == NULL || subjectHash == NULL || issuerHash == NULL)
675+
if (bs == NULL || subjectNameHash == NULL || issuerNameHash == NULL)
676676
return BAD_FUNC_ARG;
677677

678678
for (single = bs->single; single != NULL; single = single->next) {
679679
int passed = 0;
680680

681681
if (subjectKeyHash != NULL &&
682-
XMEMCMP(subjectHash, single->issuerHash,
682+
XMEMCMP(subjectNameHash, single->issuerHash,
683683
OCSP_DIGEST_SIZE) == 0 &&
684684
XMEMCMP(subjectKeyHash, single->issuerKeyHash,
685-
OCSP_DIGEST_SIZE) == 0) {
685+
KEYID_SIZE) == 0) {
686686
WOLFSSL_MSG("\tOCSP Response signed by issuer");
687687
passed = 1;
688688
}
689689
else if ((extExtKeyUsage & EXTKEYUSE_OCSP_SIGN) != 0) {
690690
if (issuerKeyHash != NULL &&
691-
XMEMCMP(issuerHash, single->issuerHash,
691+
XMEMCMP(issuerNameHash, single->issuerHash,
692692
OCSP_DIGEST_SIZE) == 0 &&
693693
XMEMCMP(issuerKeyHash, single->issuerKeyHash,
694-
OCSP_DIGEST_SIZE) == 0) {
694+
KEYID_SIZE) == 0) {
695695
WOLFSSL_MSG("\tOCSP Response signed by authorized responder "
696696
"delegated by issuer");
697697
passed = 1;
698698
}
699699
#ifndef WOLFSSL_NO_OCSP_ISSUER_CHAIN_CHECK
700700
else if (vp != NULL) {
701-
passed = CheckOcspResponderChain(single, issuerHash,
701+
passed = CheckOcspResponderChain(single, issuerNameHash,
702702
issuerKeyHash, vp, bs->pendingCAs);
703703
}
704704
#endif

‎wolfssl/ocsp.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,8 @@ WOLFSSL_LOCAL int CheckOcspResponse(WOLFSSL_OCSP *ocsp, byte *response, int resp
7474
OcspEntry *entry, OcspRequest *ocspRequest,
7575
void* heap);
7676

77-
WOLFSSL_LOCAL int CheckOcspResponder(OcspResponse *bs, byte* subjectHash,
78-
byte* subjectKeyHash, byte extExtKeyUsage, byte* issuerHash,
77+
WOLFSSL_LOCAL int CheckOcspResponder(OcspResponse *bs, byte* subjectNameHash,
78+
byte* subjectKeyHash, byte extExtKeyUsage, byte* issuerNameHash,
7979
byte* issuerKeyHash, void* vp);
8080

8181
/* Allocates and initializes a WOLFSSL_OCSP object */

‎wolfssl/wolfcrypt/asn.h‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2152,7 +2152,11 @@ struct Signer {
21522152
#endif
21532153
#ifdef HAVE_OCSP
21542154
byte subjectKeyHash[KEYID_SIZE];
2155-
byte issuerKeyHash[KEYID_SIZE]; /* key hash of verifying parent CA */
2155+
byte issuerKeyHash[KEYID_SIZE]; /* subject key hash of the immediate
2156+
* issuer CA (i.e. the parent that signed
2157+
* this cert), used to bind OCSP CertID
2158+
* issuerKeyHash matching during responder
2159+
* authorization checks */
21562160
#endif
21572161
#if defined(WOLFSSL_AKID_NAME) || defined(HAVE_CRL)
21582162
byte serialHash[SIGNER_DIGEST_SIZE]; /* serial number hash */

0 commit comments

Comments
 (0)