0
$\begingroup$

can anyone tell me for sure if OCSP multi stapling is supported by/implemented in the current version of OpenSSL?

Those are the hints I found on the Web:

OCSP stapling now is supported by OpenSSL, see also a security note from 22 September 2016: https://www.openssl.org/news/secadv/20160922.txt

Mailing list entry from February 2016 discussing it: https://mta.openssl.org/pipermail/openssl-dev/2016-February/005309.html

When looking on the GitHub project, you see a "status_request_v2" entry (the TLS handshake extension for OCSP multi-stapling): github.com/openssl/openssl/blob/master/crypto/x509v3/v3_tlsf.c#L50

Does anyone have more insight into the current version of OpenSSL regarding OCSP multi-stapling?

$\endgroup$
  • $\begingroup$ This is what source is open for, I believe: you can know yourself, for sure. $\endgroup$ – Vadym Fedyukovych Jan 6 '17 at 14:45
1
$\begingroup$

Still unsupported.

I think it still is not supported.

From openssl/blob/master/ssl/statem/extensions_srvr.c:

if (s->tlsext_status_type != TLSEXT_STATUSTYPE_ocsp) {
    /*
     * We don't know what to do with any other type so ignore it.
     */
    s->tlsext_status_type = TLSEXT_STATUSTYPE_nothing;
    return 1;
}

And from openssl/blob/master/doc/man3/SSL_CTX_set_tlsext_status_cb.pod

A client application may request that a server send back an OCSP status response (also known as OCSP stapling). ... Currently the only supported type is TLSEXT_STATUSTYPE_ocsp.

| improve this answer | |
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.