can anyone tell me for sure if OCSP multi stapling is supported by/implemented in the current version of OpenSSL?

Those are the hints I found on the Web:

OCSP stapling now is supported by OpenSSL, see also a security note from 22 September 2016: https://www.openssl.org/news/secadv/20160922.txt

Mailing list entry from February 2016 discussing it: https://mta.openssl.org/pipermail/openssl-dev/2016-February/005309.html

When looking on the GitHub project, you see a "status_request_v2" entry (the TLS handshake extension for OCSP multi-stapling): github.com/openssl/openssl/blob/master/crypto/x509v3/v3_tlsf.c#L50

Does anyone have more insight into the current version of OpenSSL regarding OCSP multi-stapling?

  • $\begingroup$ This is what source is open for, I believe: you can know yourself, for sure. $\endgroup$ – Vadym Fedyukovych Jan 6 '17 at 14:45

Still unsupported.

I think it still is not supported.

From openssl/blob/master/ssl/statem/extensions_srvr.c:

if (s->tlsext_status_type != TLSEXT_STATUSTYPE_ocsp) {
     * We don't know what to do with any other type so ignore it.
    s->tlsext_status_type = TLSEXT_STATUSTYPE_nothing;
    return 1;

And from openssl/blob/master/doc/man3/SSL_CTX_set_tlsext_status_cb.pod

A client application may request that a server send back an OCSP status response (also known as OCSP stapling). ... Currently the only supported type is TLSEXT_STATUSTYPE_ocsp.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.