{"action":"opened","issue":{"url":"https://api.github.com/repos/openssl/openssl/issues/7383","repository_url":"https://api.github.com/repos/openssl/openssl","labels_url":"https://api.github.com/repos/openssl/openssl/issues/7383/labels{/name}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/7383/comments","events_url":"https://api.github.com/repos/openssl/openssl/issues/7383/events","html_url":"https://github.com/openssl/openssl/issues/7383","id":368820085,"node_id":"MDU6SXNzdWUzNjg4MjAwODU=","number":7383,"title":"OpenSSL OCSP responder failing when request comes from MS Remote Desktop Service (Remoteapp)","user":{"login":"adriano-pinaffo","id":28174227,"node_id":"MDQ6VXNlcjI4MTc0MjI3","avatar_url":"https://avatars1.githubusercontent.com/u/28174227?v=4","gravatar_id":"","url":"https://api.github.com/users/adriano-pinaffo","html_url":"https://github.com/adriano-pinaffo","followers_url":"https://api.github.com/users/adriano-pinaffo/followers","following_url":"https://api.github.com/users/adriano-pinaffo/following{/other_user}","gists_url":"https://api.github.com/users/adriano-pinaffo/gists{/gist_id}","starred_url":"https://api.github.com/users/adriano-pinaffo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriano-pinaffo/subscriptions","organizations_url":"https://api.github.com/users/adriano-pinaffo/orgs","repos_url":"https://api.github.com/users/adriano-pinaffo/repos","events_url":"https://api.github.com/users/adriano-pinaffo/events{/privacy}","received_events_url":"https://api.github.com/users/adriano-pinaffo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-10T19:36:00Z","updated_at":"2018-10-10T19:36:00Z","closed_at":null,"author_association":"NONE","body":"Here is my scenario:\r\n\r\nI have a root and intermediate CA in CentOS, with OpenSSL 1.0.2k-fips. I also set up a OCSP responder in the intermediate CA, to respond the status of issued certificates. I also have a Windows 2012 R2 server with Remote Desktop Services enabled. I issued a certificate for it using my OpenSSL intermediate CA.\r\n\r\nWhen I use OpenSSL tools to check the status of the certificate, it returns with `Response verify OK`, `certificate good`.\r\n\r\n```\r\n$ openssl ocsp -CAfile chain.mydomain.crt.pem -url http://myfqdn-ocsp-responder:8888 -resp_no_certs -issuer int.mydomain.crt.pem -cert server.mydomain.crt.pem\r\nResponse verify OK\r\nserver.mydomain.crt.pem: good\r\n        This Update: Oct 10 16:44:50 2018 GMT\r\n```\r\n\r\nWhen I use the RDP connection (either the RDP file itself or the RemoteApp webaccess, I get `A revocation check could not be performed for the certificate` error, although it lets me go through and continue. The Certificate has the OCSP information correctly, though.\r\n![01](https://user-images.githubusercontent.com/28174227/46759362-9b2eb600-cca5-11e8-93a8-168f95c0185f.png)\r\nBut that´s really annoying for the users and I wanted to get rid of this error. In the OCSP responder server I get a couple of `Invalid request` errors and the log.tx has `Responder Error: malformedrequest (1)` message.\r\n\r\nThe OCSP responder was started with:\r\n`# openssl ocsp -index ../index.txt -port 8888 -rsigner certs/ocspserver.mydomain.crt.pem -rkey private/ocspserver.mydomain.key.pem -CA ../certs/int.mydomain.crt.pem -text -ignore_err -out log.txt&`\r\n\r\nOn the OCSP responder I captured the traffic, and to my surprise it seems OpenSSL and MS RDP check the certificate status in very different ways:\r\n\r\n**For OpenSSL checking:**\r\nOCSP Request is sent, it has inside the `hashAlgorithm`, `issuerNameHash`, `issuerKeyHash `and `serialNumber`.\r\nIt receives back a OCSP Response with `responseStatus: successful (0)`\r\nWireshark capture image: request\r\n![02](https://user-images.githubusercontent.com/28174227/46759782-9a4a5400-cca6-11e8-84e2-46ebe1b21904.png)\r\n\r\nWireshark capture image: response\r\n![05](https://user-images.githubusercontent.com/28174227/46760532-ab946000-cca8-11e8-9ff1-922b686b1fcd.png)\r\n\r\n**For MS RDP checking:**\r\nAfter the regular 3way handshake, the server sends an HTTP GET where the `User-Agent` is `Microsoft-CryptoAPI/6.3` and the Full request URI is `http://ocspserver.mydomain:8888/<a bunch of apparently random characters>`\r\nTo that the OCSP responds with an OCSP Response packet with `responseStatus: malformedRequest (1)`\r\nFollowing that event the server establishes a new 3way handshake, and now sends a OCSP Request, very similar to the one sent by OpenSSL. The OCSP responder responds with a OCSP Response with `responseStatus: successful (0)`. That back and fourth is done 3 times.\r\nWireshark capture back and fourth image \r\n![03](https://user-images.githubusercontent.com/28174227/46760043-48ee9480-cca7-11e8-8deb-5920619e06ba.png)\r\n\r\nWireshark 1st request: server -> OCSP responder (HTTP GET)\r\n![04](https://user-images.githubusercontent.com/28174227/46760335-345ecc00-cca8-11e8-87c7-182ed11132be.png)\r\n\r\nWireshark 1st response: OCSP responder -> server (OCSP)\r\n![08](https://user-images.githubusercontent.com/28174227/46761302-7db01b00-ccaa-11e8-84f8-c44df15e022b.png)\r\n\r\nWireshark 2nd request: server -> OCSP responder (OCSP)\r\n![06](https://user-images.githubusercontent.com/28174227/46760689-1a71b900-cca9-11e8-953e-77bc917a2f27.png)\r\n\r\n\r\nWireshark 2nd response: OCSP responder -> server (OCSP)\r\n![07](https://user-images.githubusercontent.com/28174227/46760780-5c026400-cca9-11e8-9606-3735e2232e79.png)\r\n\r\nApparently the second request by MS RDP, which gets a successful response, is ignored.\r\nDoes anyone know why this is happening?\r\n\r\nThank you,"}}
{"actor":{"display_login":"adriano-pinaffo"}}