• Registered: 2016-06-15
  • Posts: 29

Topic: wolfSSL verification of cert chain

I have a few basic questions about wolfSSL

How can it verify a cert chain, if I only specify a CA cert? From where does it get intermediate certs from? (like intermediate CAs)?

Also related to this, assuming I just use OCSP stapling (not V2), and assuming I have a cert chain, does wolfSSL receive and verify an OCSP response for the immediate parent in the chain?

Share

  • Registered: 2016-06-15
  • Posts: 29

Re: wolfSSL verification of cert chain

Based on my understanding of the SSL protocol and the wolfSSL behavior (https://www.wolfssl.com/wolfSSL/Docs-wo … cates.html), it seems that we only need the root CA.

However, at this point, I am guessing that for normal OCSP stapling (not v2), the OCSP response that wolfSSL will receive and verify would pertain to the SSL host it is connecting to. Is this understanding correct?

Share

  • john
  • Moderator
  • Offline
  • From: Seattle, WA
  • Registered: 2011-11-14
  • Posts: 140

Re: wolfSSL verification of cert chain

Correct, you only need the root CA. The other intermediate signers should be in the certificate chain with the peer certificate.

For OCSP stapling, the client should be getting the OCSP response record, signed by the root CA (or its delegate), during the handshake. The OCSP response should be for the server's certificate. (And the response should be the same blob of data you would get if you requested the status directly from the OCSP service listed in the peer's certificate.)

john's Website

Share