Nginx: ssl_stapling_verify: What exactly is being verified

nginxocsp

What exactly does the ssl_stapling_verify directive? Does it check if the signature of the answer is correct? The official nginx documentation is very vague in explaining this:

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling_verify

Enables or disables verification of OCSP responses by the server.

For verification to work, the certificate of the server certificate issuer, the root certificate, and all intermediate certificates should be configured as trusted using the ssl_trusted_certificate directive.

Best Answer

I found in Nginx souce code. the file ngx_event_openssl_stapling.c#L660:

OCSP_basic_verify(basic, chain, store,staple->verify ? OCSP_TRUSTOTHER :OCSP_NOVERIFY
if you config `ssl_stapling_verify` value is on, then `staple->verify` will true, next the function `OCSP_basic_verify` will use `OCSP_TRUSTOTHER ` param to verified.

then, I found the OCSP_basic_verify function in openssl libaray, it said:

Then the function already returns success if the flags contain OCSP_NOVERIFY or if the signer certificate was found in certs and the flags contain OCSP_TRUSTOTHER.

the more about is here: https://meto.cc/article/what-exactly-did-ssl_stapling_verify-verify

Related Topic