37 lines
2.6 KiB
Markdown
37 lines
2.6 KiB
Markdown
# OCSP/CRL Certificate Status Provider
|
|
|
|
## Module
|
|
__Libraries
|
|
|
|
## Status
|
|
VERIFIED
|
|
|
|
## Description
|
|
Full OCSP client and CRL fetcher for certificate revocation checking, as specified in the advisory.
|
|
|
|
## Implementation Details
|
|
- **OcspClient**: `src/__Libraries/StellaOps.Cryptography.CertificateStatus/OcspClient.cs` -- RFC 6960 OCSP client: `CheckStatusAsync(certificate, issuer, options)` extracts OCSP responder URL from AIA extension (OID 1.3.6.1.5.5.7.1.1), generates ASN.1 DER OCSP request with CertID (SHA-256 issuer name hash + issuer key hash + serial number), supports optional nonce (OID 1.3.6.1.5.5.7.48.1.2), uses GET for requests <= 255 bytes / POST for larger; parses `BasicOCSPResponse` with tbsResponseData (producedAt, certStatus: good[0]/revoked[1]/unknown[2], thisUpdate, nextUpdate); caches good responses per thumbprint; `ParseStapledResponse` for pre-fetched OCSP responses
|
|
- **CrlFetcher**: `src/__Libraries/StellaOps.Cryptography.CertificateStatus/CrlFetcher.cs` -- CRL distribution point fetching and revocation checking
|
|
- **CertificateStatusProvider**: `src/__Libraries/StellaOps.Cryptography.CertificateStatus/CertificateStatusProvider.cs` -- unified provider combining OCSP and CRL status checks
|
|
- **CertificateStatusServiceCollectionExtensions**: `src/__Libraries/StellaOps.Cryptography.CertificateStatus/CertificateStatusServiceCollectionExtensions.cs` -- DI registration
|
|
- **Abstractions**: `src/__Libraries/StellaOps.Cryptography.CertificateStatus.Abstractions/` -- `CertificateStatusResult` (Status, Source, ProducedAt, ThisUpdate, NextUpdate, ResponderUrl, RawOcspResponse, revocation details), `RevocationStatus` enum (Good, Revoked, Unknown), `RevocationSource` enum (Ocsp, Crl), `RevocationReason` enum, `CertificateStatusOptions` (EnableCaching, IncludeOcspNonce, RequestTimeout, MaxOcspAge)
|
|
- **Source**: Feature matrix scan
|
|
|
|
## E2E Test Plan
|
|
- [ ] Verify OCSP client generates valid ASN.1 DER request with correct CertID
|
|
- [ ] Test OCSP nonce inclusion when IncludeOcspNonce is enabled
|
|
- [ ] Verify GET method is used for small requests (<= 255 bytes) and POST for larger
|
|
- [ ] Test OCSP response parsing detects good, revoked, and unknown certificate status
|
|
- [ ] Verify revoked status includes revocation time and reason
|
|
- [ ] Test response caching for good certificates with nextUpdate expiry
|
|
- [ ] Verify CRL fetcher retrieves and parses CRL distribution point data
|
|
- [ ] Test unified CertificateStatusProvider combines OCSP and CRL results
|
|
|
|
|
|
## Verification
|
|
|
|
- **Verified**: 2026-02-13T20:30:00Z
|
|
- **Run**: run-001
|
|
- **Tier**: Tier 2d (Library/Internal)
|
|
- **Verdict**: PASS
|