[exim-dev] [Bug 1544] Full-fat OCSP/CRL support

Página Principal
Apagar esta mensagem
Responder a esta mensagem
Autor: Jeremy Harris
Data:  
Para: exim-dev
Assunto: [exim-dev] [Bug 1544] Full-fat OCSP/CRL support
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=1544

Jeremy Harris <jgh146exb@???> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|pdp@???                |jgh146exb@???





--- Comment #1 from Jeremy Harris <jgh146exb@???> 2014-12-14 21:27:15 ---
I'm thinking in terms of

- a stream socket to talk to the external service
- a main-section option to specify the connection and enable the feature
- use of the service by the client-side TLS implementation, when a certificate-
status request was made (due to host_require_ocsp or hosts_request_ocsp) but
no status response was forthcoming
- a request carrying enough info for the service to make an RFC2560 OCSP
request and to do a CRL fetch
- a response saying one of
-- OK (the certificate has been validated)
-- FAIL (the certificate has been definitely determined to be invalid)
-- ERROR (the request was poorly formatted or had insufficient information)
-- NOTYET (information on the status of the certificate is not immediately
           available, but a later enquiry may get a definitive response)



--
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email