OCSP_basic_verify does not work with OpenSSL 1.1.1

[h2o]

OCSP_basic_verify does not work with OpenSSL 1.1.1

[kazuho]

Thank you for noticing, diagnosing, reporting, and fixing the issue.

#23 that fixes the 1st issue has been merged. Are you aware a method reproducing the 2nd issue?

[tatsuhiro-t]

You can create OCSP response using openssl ocsp utility and can include certificate in it.

[tatsuhiro-t]

Create OCSP request

openssl ocsp -issuer CA.crt -cert server.crt -reqout req.der

Create OCSP response

openssl ocsp -index index.txt -rsigner CA.crt -rkey CA.key -CA CA.crt -reqin req.der -respout resp.der

Syntax of index.txt

Tab delimited text files:

• V = verified, R = revoked, E = expired
• YYMMDDhhmmddZ: expiration date of certificate
• YYMMDDhhmmddZ: revoked date (empty if it has not been revoked)
• Serial: Serial number of certificate in hex (alphabet must be upper cased)
• Path to certificate: just write unknown
• Subject: /X=Z... style

Describe OCSP response

openssl ocsp -respin resp.der -text