[RFE] CRL/OCSP checks for TLS

[jirib]

With recent heartbleed OpenSSL bug, topic about revoking certs has been raised. If your setup is compromised one could still be MITMed without revoking old keys.

Postfix does not do any CRL/OCSP checks for TLS - https://postfix.1071664.n5.nabble.com/TLS-Certificate-signature-failure-what-is-the-reason-td62435.html#a62502

Maybe OpenSMTPd could be one giving the trend.

[poolpOrg]

this will be worked out soon, when LibreSSL development improves a bit the current situation.

CRL/OCSP is a major major major pain in the ass atm

[ArchangeGabriel]

What is the status of this issue? OCSP is implemented in other projects, like nginx for instance. ;)

[poolpOrg]

ticket is pending, feel free to give a try at implementing it until we manage to

[ArchangeGabriel]

Also thought I would just write here that OCSP Stapling on OpenSMTPD side should be part of this OCSP support, and allowing to specify resolver should be considered too. ;)

[jirib]

OCSP Stapling just hit OpenBSD tree, libtls and nc, so maybe opensmtpd would benefit from this.

[poolpOrg]

Unfortunately, OpenSMTPD can't use libtls yet as we still support OpenSSL :-/

[MrSorcus]

Up. Any news on this?

[ArchangeGabriel]

One workaround I’m going to try soon is to let e.g. nginx handle the TLS part of the connection, though that only works when receiving, not when relaying (I’m not sure this can be done, but in any case would likely require more work).

[poolpOrg]

work has begun to switch OpenSMTPD to libtls which will solve this issue.

stay tuned.

[poolpOrg]

I have written the code but waiting for a LibreSSL hacker to confirm I'm doing the right thing :-)

[poolpOrg]

libtls branch has switched to ocsp aware keypair loading.

I'm waiting for a diff to be committed to LibreSSL before I can test this for real outside of my laptop and close the ticket.

[ArchangeGabriel]

What is the status here now that OpenSMTPD uses libtls? OCSP Stapling (on server side) and checking (on client side) is supported by exim afaik, not sure about postfix, but having it in OpenSMTPD would be nice. ;)

PS: Just to be clear, I’m not necessarily asking for an answer from @poolpOrg, but since @omar-polo revived the project, maybe they would know about this?

[poolpOrg]

Hmmm, well the code is already written but is very outdated, I'm not even sure it can merge.

Now that someone volunteered to take care of portable, I may be tempted to submit back some features upstream, including this one, I'll see if I can get around it next week.