{"action":"created","issue":{"url":"https://api.github.com/repos/openssl/openssl/issues/2159","repository_url":"https://api.github.com/repos/openssl/openssl","labels_url":"https://api.github.com/repos/openssl/openssl/issues/2159/labels{/name}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/2159/comments","events_url":"https://api.github.com/repos/openssl/openssl/issues/2159/events","html_url":"https://github.com/openssl/openssl/issues/2159","id":198143183,"node_id":"MDU6SXNzdWUxOTgxNDMxODM=","number":2159,"title":"OCSP verify produces misleading errors when -VAfile certificate has expired","user":{"login":"tlhackque","id":332018,"node_id":"MDQ6VXNlcjMzMjAxOA==","avatar_url":"https://avatars0.githubusercontent.com/u/332018?v=4","gravatar_id":"","url":"https://api.github.com/users/tlhackque","html_url":"https://github.com/tlhackque","followers_url":"https://api.github.com/users/tlhackque/followers","following_url":"https://api.github.com/users/tlhackque/following{/other_user}","gists_url":"https://api.github.com/users/tlhackque/gists{/gist_id}","starred_url":"https://api.github.com/users/tlhackque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tlhackque/subscriptions","organizations_url":"https://api.github.com/users/tlhackque/orgs","repos_url":"https://api.github.com/users/tlhackque/repos","events_url":"https://api.github.com/users/tlhackque/events{/privacy}","received_events_url":"https://api.github.com/users/tlhackque/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/openssl/openssl/milestones/9","html_url":"https://github.com/openssl/openssl/milestone/9","labels_url":"https://api.github.com/repos/openssl/openssl/milestones/9/labels","id":2145708,"node_id":"MDk6TWlsZXN0b25lMjE0NTcwOA==","number":9,"title":"1.1.1","description":"","creator":{"login":"levitte","id":698918,"node_id":"MDQ6VXNlcjY5ODkxOA==","avatar_url":"https://avatars1.githubusercontent.com/u/698918?v=4","gravatar_id":"","url":"https://api.github.com/users/levitte","html_url":"https://github.com/levitte","followers_url":"https://api.github.com/users/levitte/followers","following_url":"https://api.github.com/users/levitte/following{/other_user}","gists_url":"https://api.github.com/users/levitte/gists{/gist_id}","starred_url":"https://api.github.com/users/levitte/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/levitte/subscriptions","organizations_url":"https://api.github.com/users/levitte/orgs","repos_url":"https://api.github.com/users/levitte/repos","events_url":"https://api.github.com/users/levitte/events{/privacy}","received_events_url":"https://api.github.com/users/levitte/received_events","type":"User","site_admin":false},"open_issues":40,"closed_issues":357,"state":"open","created_at":"2016-11-19T09:18:52Z","updated_at":"2018-07-02T16:02:58Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2016-12-30T12:41:41Z","updated_at":"2018-07-02T16:03:38Z","closed_at":null,"author_association":"NONE","body":"OpenSSL 1.0.2h  3 May 2016\r\n\r\nWhen ocsp is used to verify a certificate and the (responder) certificate specified by -VAfile has expired, ocsp should report an error related to the -VAfile certificate.   (E.g. \"responder certificate expired\")\r\n\r\nInstead, it reports errors indicating corruption of the response, including:\r\n````\r\nResponse Verify Failure\r\n3086837916:error:04067084:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data too large for modulus:rsa_eay.c:670:\r\n3086837916:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:a_verify.c:218:\r\n3086837916:error:27069075:OCSP routines:OCSP_basic_verify:signature failure:ocsp_vfy.c:105:\r\n\r\nand\r\n\r\nResponse Verify Failure\r\n139938102994800:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1.c:102:\r\n139938102994800:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:rsa_eay.c:797:\r\n139938102994800:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:a_verify.c:241:\r\n139938102994800:error:27069075:OCSP routines:OCSP_basic_verify:signature failure:ocsp_vfy.c:101:\r\n````\r\n\r\nThis led to several weeks of troubleshooting, as there were legitimate data corruption issues with a responder just prior to its certificate's expiration.  Thus, certificate expiration masqueraded as a recurrence of those issues.\r\n\r\nThe attached .zip file can be used to demonstrate this issue.  It includes a valid certificate (avh.cer), an issuer cert (root_bundle.crt), an expired responder certificate (startcom_ocsp_dec16.pem) and a current responder certificate (startcom_ocsp.pem).\r\n\r\nBelow is the full failing command with output:\r\n````\r\nopenssl ocsp -issuer root_bundle.crt -cert avh.crt -url http://ocsp.startssl.com -header 'host' 'ocsp.startssl.com' -CAfile /mnt/wikiworld/usr/local/share/perl5/Mozilla/CA/cacert.pem   -VAfile startcom_ocsp_dec16.pem\r\nWARNING: no nonce in response\r\nResponse Verify Failure\r\n3086837916:error:04067084:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data too large for modulus:rsa_eay.c:670:\r\n3086837916:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:a_verify.c:218:\r\n3086837916:error:27069075:OCSP routines:OCSP_basic_verify:signature failure:ocsp_vfy.c:105:\r\navh.crt: good\r\n        This Update: Dec 30 10:29:17 2016 GMT\r\n        Next Update: Jan  3 10:39:17 2017 GMT\r\n````\r\n\r\nA reasonable error would be something like \"Certificate in -VAfile invalid: expired\"\r\n\r\nWith the valid certificate in -VAfile, the sample certificate validates normally.\r\n\r\n[expired.ZIP.txt](https://github.com/openssl/openssl/files/678600/expired.ZIP.txt)\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/openssl/openssl/issues/comments/401853675","html_url":"https://github.com/openssl/openssl/issues/2159#issuecomment-401853675","issue_url":"https://api.github.com/repos/openssl/openssl/issues/2159","id":401853675,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTg1MzY3NQ==","user":{"login":"mattcaswell","id":7422273,"node_id":"MDQ6VXNlcjc0MjIyNzM=","avatar_url":"https://avatars0.githubusercontent.com/u/7422273?v=4","gravatar_id":"","url":"https://api.github.com/users/mattcaswell","html_url":"https://github.com/mattcaswell","followers_url":"https://api.github.com/users/mattcaswell/followers","following_url":"https://api.github.com/users/mattcaswell/following{/other_user}","gists_url":"https://api.github.com/users/mattcaswell/gists{/gist_id}","starred_url":"https://api.github.com/users/mattcaswell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattcaswell/subscriptions","organizations_url":"https://api.github.com/users/mattcaswell/orgs","repos_url":"https://api.github.com/users/mattcaswell/repos","events_url":"https://api.github.com/users/mattcaswell/events{/privacy}","received_events_url":"https://api.github.com/users/mattcaswell/received_events","type":"User","site_admin":false},"created_at":"2018-07-02T16:03:38Z","updated_at":"2018-07-02T16:03:38Z","author_association":"MEMBER","body":"Since this is not 1.1.1 specific (impacts 1.0.2), removing the 1.1.1 milestone."}}
{"actor":{"display_login":"mattcaswell"}}