Add support for OCSP Stapling to OpenSSL I/O Handler #19
Labels
Element: SSL/TLS
Issues related to SSL/TLS handling, TIdSSLIOHandlerSocketBase and descendants
Status: Deferred
Issue to be re-reviewed in a future release
Type: Enhancement
Issue is proposing a new feature/enhancement
See https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_tlsext_status_cb.html
In a nutshell:
On the client side, prior to starting a SSL/TLS handshake, call
SSL_CTX_set_tlsext_status_cb()
to enable a status callback function, andSSL_set_tlsext_status_type(TLSEXT_STATUSTYPE_ocsp)
to request OCSP from the server. The callback function can then useSSL_get_tlsext_status_ocsp_resp()
andd2i_OCSP_RESPONSE()
to access the server's OCSP response data.On the server side, call
SSL_CTX_set_tlsext_status_cb()
to enable a status callback function. The callback function can then useSSL_get_certificate()
to access the certificate that is being sent to the client, obtain the desired OCSP response to be sent back as needed, and finally useSSL_set_tlsext_status_ocsp_resp()
to include that response data with the certificate.The text was updated successfully, but these errors were encountered: