add support for TLS 1.3 OCSP multi-stapling for server certs by mikrue · Pull Request #20945 · openssl/openssl

mikrue · 2023-05-11T18:27:47Z

OCSP multistapling for TLSv1.3:

changed resp variable in the the ssl_struct from one DER encoded OCSP response to a stack of responses
server side: added function in s_server code for retrieving the OCSP responses from all certificates in the server cert chain
server side: added function in statem_srvr code to retrieve and return the response for the requested certificate
client side: added verify function for multiple OCSP responses

Checklist

documentation is added or updated
tests are added or updated

Configurations/10-main.conf

t8m · 2023-05-12T08:07:56Z

We will need a CLA to be able to accept this PR. https://www.openssl.org/policies/cla.html

mikrue · 2023-05-12T08:17:02Z

Hi! I have already provided a CLA last October… Anyways, here’s the CLA again. I hope this is still valid, if not, please let me know and I will create a new one. Best regards Michael

Am 12.05.2023 um 10:08 schrieb Tomáš Mráz ***@***.***>: We will need a CLA to be able to accept this PR. https://www.openssl.org/policies/cla.html — Reply to this email directly, view it on GitHub <#20945 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AL6KEQRLRVDNEHJ7F42S4J3XFXVWPANCNFSM6AAAAAAX6QEZ2I>. You are receiving this because you authored the thread.

t8m · 2023-05-12T08:50:01Z

Ah, Michal Krueger has CLA in our system, but Martin Rauch does not.

martinRa2 · 2023-05-12T09:49:32Z

Just sent the CLA via email :-)

FdaSilvaYY

Same blocking issue as in your previous #19183 contribution :
you must not modify existing methods

A bunch of style issue who are less important considering the 1st one.

ssl/s3_lib.c

crypto/x509/x509_vfy.c

DDvO · 2023-05-23T05:59:53Z

@martinRa2 wrote 11 days ago:

Just sent the CLA via email :-)

For some reason, the CLI hold is still present.

t8m · 2023-05-23T13:21:58Z

@martinRa2 @DDvO we do not have CCLA confirmation for Martin Rauch yet.

martinRa3 · 2023-05-23T14:00:23Z

Could you please reopen the pulll request. I have to clarify something and will provide my CCLA as soon as possible.

t8m · 2023-05-23T14:10:21Z

Could you please reopen the pulll request. I have to clarify something and will provide my CCLA as soon as possible.

It is not closed.

DDvO

Nice work.
Yet there are still many (mostly minor) points to be improved.
There are two major ones:

the existing API must be retained for backward compatibility
the new features (more than one stapled OCSP response, and cert verify using stapled OCSP responses) must be tested with new test cases.

apps/s_client.c

doc/man1/openssl-s_client.pod.in

apps/s_client.c

apps/lib/s_cb.c

doc/man1/openssl-s_client.pod.in

test/sslapitest.c

crypto/x509/x509_vfy.c

mikrue · 2023-06-30T12:34:12Z

closing pull request and re-open it to get rid of the "CLA missing" tags...

mikrue · 2023-06-30T12:34:25Z

re-opening...

Co-authored-by: Michael Krueger

DDvO · 2025-07-21T09:41:53Z

@martinRa2 there are a few very minor CI issues (coding style and a type conversion disliked by Windows compiler).

martinRa2 · 2025-07-22T12:23:48Z

Hello @DDvO,
thanks for the hint. I fixed the conversion issue, but the code style looks good for me.
@t8m can you please review my changes as well. My target is still to bring the PR into the next release.

DDvO · 2025-07-22T15:07:50Z

the code style looks good for me.

Well, the #if indentation would be fine from the local perspective,
but unfortunately it is not from the overall file perspective,
because all the lines 42 to 60 in apps/s_server.c should be indented by one more space.
Please do so, fixing the pre-existing mistakes also for the lines that you otherwise would not need to touch there,
because otherwise the tool will keep complaining

  apps/s_server.c:57:'#if' nesting indent = 1 != 2:# include <openssl/ebcdic.h>
  apps/s_server.c:58:'#if' nesting indent = 0 != 1:#endif
  apps/s_server.c:60:'#if' nesting indent = 0 != 1:#include "internal/statem.h"

martinRa3 · 2025-07-24T11:53:53Z

Hello @t8m , hello @DDvO,

thanks for approving the PR. What about the style validations? Should I still fix them or are they accepted?

DDvO

Reconfirming after the changes recently requested by @t8m.
The remaining minor coding style validations have been waived.
The other CI failure is unrelated.

openssl-machine · 2025-07-25T13:00:39Z

This pull request is ready to merge

t8m · 2025-07-25T15:25:09Z

Merged to the master branch. Thank you for your contribution.

Co-authored-by: Michael Krueger Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #20945)

apps/s_server.c

test/sslapitest.c

openssl-machine added the hold: cla required The contributor needs to submit a license agreement label May 11, 2023

t8m reviewed May 12, 2023

View reviewed changes

Configurations/10-main.conf Show resolved Hide resolved

FdaSilvaYY reviewed May 13, 2023

View reviewed changes

ssl/s3_lib.c Show resolved Hide resolved

crypto/x509/x509_vfy.c Outdated Show resolved Hide resolved

crypto/x509/x509_vfy.c Outdated Show resolved Hide resolved

crypto/x509/x509_vfy.c Outdated Show resolved Hide resolved

martinRa2 force-pushed the master branch from 0d30683 to 60db478 Compare May 14, 2023 18:32

github-actions bot added the severity: fips change The pull request changes FIPS provider sources label May 23, 2023

t8m closed this May 23, 2023

t8m reopened this May 23, 2023

github-actions bot removed the severity: fips change The pull request changes FIPS provider sources label May 23, 2023

DDvO changed the title ~~added support for OCSP multi stapling~~ add support for OCSP multi-stapling for server certs May 26, 2023

DDvO added this to the 3.2.0 milestone May 27, 2023

DDvO changed the title ~~add support for OCSP multi-stapling for server certs~~ add support for TLS 1.3 OCSP multi-stapling for server certs May 27, 2023

DDvO requested changes May 28, 2023

View reviewed changes

DDvO added branch: master Applies to master branch triaged: feature The issue/pr requests/adds a feature hold: needs tests The PR needs tests to be added to it labels May 28, 2023

DDvO reviewed May 28, 2023

View reviewed changes

crypto/x509/x509_vfy.c Outdated Show resolved Hide resolved

martinRa2 force-pushed the master branch from 3c8a621 to f989a3e Compare June 16, 2023 10:54

github-actions bot added the severity: fips change The pull request changes FIPS provider sources label Jun 23, 2023

mikrue closed this Jun 30, 2023

mikrue reopened this Jun 30, 2023

martinRa2 added 2 commits July 18, 2025 15:16

Add support for TLS 1.3 OCSP multi-stapling for server certs

f586685

Co-authored-by: Michael Krueger

fixup! Add support for TLS 1.3 OCSP multi-stapling for server certs

7545867

martinRa2 force-pushed the master branch from 76dc5c3 to 7545867 Compare July 20, 2025 20:12

fixup! Add support for TLS 1.3 OCSP multi-stapling for server certs

48c4c14

fixup! Add support for TLS 1.3 OCSP multi-stapling for server certs

2db66d3

fixup! Add support for TLS 1.3 OCSP multi-stapling for server certs

371adff

t8m approved these changes Jul 24, 2025

View reviewed changes

t8m added the style: waived exempted from style checks label Jul 24, 2025

DDvO approved these changes Jul 24, 2025

View reviewed changes

DDvO added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Jul 24, 2025

openssl-machine removed the approval: done This pull request has the required number of approvals label Jul 25, 2025

openssl-machine added the approval: ready to merge The 24 hour grace period has passed, ready to merge label Jul 25, 2025

t8m closed this Jul 25, 2025

github-project-automation bot moved this from In progress to Done in Project Board Jul 25, 2025

vdukhovni reopened this Jul 26, 2025

vdukhovni requested changes Jul 26, 2025

View reviewed changes

apps/s_server.c Show resolved Hide resolved

github-project-automation bot moved this from Done to In progress in Project Board Jul 26, 2025

vdukhovni reviewed Jul 26, 2025

View reviewed changes

test/sslapitest.c Show resolved Hide resolved

t8m closed this Jul 28, 2025

github-project-automation bot moved this from In progress to Done in Project Board Jul 28, 2025

mattcaswell mentioned this pull request Oct 15, 2025

TLS handshake fails between OpenSSL 3.6.0 and GnuTLS #28902

Closed

davidben mentioned this pull request Oct 23, 2025

Regression: OpenSSL 3.6 sends malformed status_request extensions with empty OCSP responses #28989

Closed

Uh oh!

Comments

Conversation

mikrue commented May 11, 2023

Checklist

Uh oh!

Uh oh!

t8m commented May 12, 2023

Uh oh!

mikrue commented May 12, 2023 via email

Uh oh!

t8m commented May 12, 2023

Uh oh!

martinRa2 commented May 12, 2023 • edited by DDvO Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FdaSilvaYY left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DDvO commented May 23, 2023

Uh oh!

t8m commented May 23, 2023

Uh oh!

martinRa3 commented May 23, 2023

Uh oh!

t8m commented May 23, 2023

Uh oh!

DDvO left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikrue commented Jun 30, 2023

Uh oh!

mikrue commented Jun 30, 2023

Uh oh!

DDvO commented Jul 21, 2025

Uh oh!

martinRa2 commented Jul 22, 2025

Uh oh!

DDvO commented Jul 22, 2025

Uh oh!

martinRa3 commented Jul 24, 2025

Uh oh!

DDvO left a comment

Choose a reason for hiding this comment

Uh oh!

openssl-machine commented Jul 25, 2025

Uh oh!

t8m commented Jul 25, 2025

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

martinRa2 commented May 12, 2023 •

edited by DDvO

Loading

DDvO left a comment •

edited

Loading