-
Notifications
You must be signed in to change notification settings - Fork 96
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Check OCSP status for every certificates in the chain #63
Comments
The ssl_exporter currently relies on the verification performed by the
So my inclination is to wait to see what happens there. |
Thanks for the heads up. In the mean time I created a branch with a PoC that fits my needs. This introduce a new metric called
Let me know if you would accept a PR with such a change. I know it could be cleaned up bit and |
I’ve opened a PR (#81) with the code we’re using in production for a while at my job. I’d be honest, this is far from useful on a daily basis (tho It might still help preventing some issues in the future if a CA revokes one of it’s intermediate certificate like GlobalSign did), so I’d understand if don’t want to add this feature into ssl_exporter. |
Hi
GlobalSign is currently revoking some of their intermediate CA certificates and I found out that ssl_exporter still considers a certificate issued by one of these intermediate CA to be valid.
To be fair, OpenSSL and GNU TLS both consider such cert as valid too:
However, some clients fails to validate this certificate and an OCSP request for the intermediate CA certificate shows that it is actually revoked:
Do you think it would be possible to implement OCSP verification on every certificate in the chain returned by the TLS server?
The text was updated successfully, but these errors were encountered: