Bug 1630469

Note: please make sure it can be configured to check for AIA when RHCS is acting as a client and as a server.

Created attachment 1485347 [details]
Downstream fix for issue.

Created attachment 1485353 [details]
Upstream version for master , of patch

I think the upstream patch can be simplified as follows:

logger.debug("ocspResponderURL: " + ocspResponderURL);
if (StringUtils.isEmpty(ocspResponderURL)) {
    ocspResponderURL = null;
}

logger.debug("ocspResponderCertNickname: " + ocspResponderCertNickname);
if (StringUtils.isEmpty(ocspResponderCertNickname)) {
    ocspResponderCertNickname = null;
}

if (ocspResponderURL == null && ocspResponderCertNickname != null) {
    throw new Exception("Missing OCSP responder URL");
}

if (ocspResponderURL != null && ocspResponderCertNickname == null) {
    throw new Exception("Missing OCSP responder certificate nickname");
}

It will also provide more descriptive error messages.

I like this version, will test it out and make double sure it does the job.

Created attachment 1485355 [details]
Revised upstream fix.

Commit master / upstream :

commit 84ce990707481556e5ba8070b54e830bc6aef7c7 (HEAD -> master, origin/master, origin/HEAD)
Author: Jack Magne <jmagne>
Date:   Thu Sep 20 18:10:09 2018 -0700

    Fix for Bug 1630469 - CC: tomcatjss: unable to enable OCSP checking from peer AIA extension.
    
    Now the server.xml can be configured to enable ocsp AND leave other settings null, to trigger
    NSS to use the AIA extension to locate the ocsp responder.
    
    ex:
    
     <Connector name="Secure" port="18443" ...
         .....
         enableOCSP="true"  ocspCacheSize="1000" ocspMinCacheEntryDuration="60" ocspMaxCacheEntryDuration="120" ocspTimeout="10"

Commit downstream / origin/TOMCATJSS_7_2_BRANCH

commit c7e9138d59833ca0b9437fd130d3d9cb2fdf393d
Author: John Magne <jmagne.redhat.com>
Date:   Thu Sep 20 21:35:20 2018 -0400

    Fix for Bug 1630469 - CC: tomcatjss: unable to enable OCSP checking from peer AIA extension.
    
        Now the server.xml can be configured to enable ocsp AND leave other settings null, to trigger
        NSS to use the AIA extension to locate the ocsp responder.
    
        ex:
    
         <Connector name="Secure" port="18443" ...
             .....
             enableOCSP="true"  ocspCacheSize="1000" ocspMinCacheEntryDuration="60" ocspMaxCacheEntryDuration="120" ocspTimeout="10"

Testing instructions:

In order to test this functionality do the following:

Create a CA
Create a KRA and make sure the AIA extension of each system cert for the KRA points to something like this:

http://test.host.com:8080/ca/ocsp

This is what you get by default if a simple kra install is done and points to the security domain of the CA during pkispawn.

Stop the KRA and reconfigure the Connector of the SSL port in the kra instances "server.xml" file such as this:

<Connector name="Secure" port="18443" ...
             .....
             enableOCSP="true"  ocspCacheSize="1000" ocspMinCacheEntryDuration="60" ocspMaxCacheEntryDuration="120" ocspTimeout="10"

Note that we have left out the settings for ocspResponderURL and ocspSigingCertNickname, or whatever the actual strings are. This means that ONLY enableOCSP="true" is set. This means that NSS will ultimately be forced to find the ocsp responder url from a given cert's AIA extension, instead of a default value we may have configured here.

Now restart the KRA while putting a tail on teh CA's log.

While the KRA restarts we should observe the CA's internal ocsp responder coming to life, verifying various certs associated with the KRA.


Note: That of course certs can be applied for with the AIA extension pointing to  outboard ocsp responders as well. When we want specific certs to hit specific responders, this is how it should be tested.