Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-6292

Common PKI CertHash OCSP extension should be a singleExtension instead of a responseExtension

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: EJBCA 6.14.0
    • Component/s: None
    • Labels:
      None
    • Stakeholder:
      Customer
    • Issue discovered during:
      Customer
    • Sprint:
      EJBCA Sprint 13

      Description

      Hi,

      I use EJBCA to provide test certificates in German/European eGovernment scenarios.

      While testing a new tool for signature verification, I noticed the CertHash extension in EJBCA putting the extension in the responseExtensions field of the OCSP ResponseData element, whereas it should be put inside the singleExtensions field of the OCSP SingleResponse element, according to Common-PKI (see Common PKI Part 9 version 2.0 page 22, table row 4: SingleResponse extension: […] ).

      In the attached patch, I implemented generic support for SingleExtensions in the OcspResponseGeneratorSessionBean together with an implementation of the CertHash extension for singleExtension. It shares code with the old extension to prevent code duplication, but it does not change the behavior of the old extension and will become active when configured explicitly in the ocsp.extensionclass property of the conf/ocsp.properties file.

      I’d like to contribute the patch to upstream; any feedback or change request is appreciated. Apply the patch with -p1 option in ejbca trunk root.

      This work is sponsored by Governikus GmbH & Co. KG.

      Regards,
      Moritz Horstmann
      Entwicklung

      Governikus GmbH & Co. KG
      Am Fallturm 9
      28359 Bremen, Germany

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                tomas Tomas Gustavsson
                Reporter:
                tomas Tomas Gustavsson
                Verified by:
                Mike Agrenius Kushner
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 2 days
                  2d
                  Remaining:
                  Remaining Estimate - 2 days
                  2d
                  Logged:
                  Time Spent - Not Specified
                  Not Specified