Forum Discussion
[OCSP Stapling] Globalsign configuration
Hi everyone, My objective is simple : I want to set OCSP Stappling configuration on my HTTPS VIP.
For that, I follow this article
For information, Globalsign is my SSL provider and I have wildcard certificate.
For test, i create in /tmp a folder that contant 4 files :
root_ca.pem --> root certificate off Globalsign inter_ca.pem --> Intermediate certificate off Globalsign chain.pem --> Concatenation off root_ca.pem and inter_ca.pem server.crt --> My server certificate (set in ssl profile on my HTTPS VIP)
If I follow the article :
openssl verify -CAfile chain_ca.pem server.crt
server.crt: OK
`
`openssl ocsp -issuer inter_ca.pem -cert server.crt -text -header "HOST" "ocsp2.globalsign.com" -url http://ocsp2.globalsign.com/gsorganizationvalsha2g2 -CAfile chain_ca.pem`
`Response verify OK
server.crt: good
This Update: Oct 3 15:33:38 2018 GMT
Next Update: Oct 7 15:33:38 2018 GMT
`
Here, all is OK.
Then, I configure a DNS Resolver (respond to dig request)
Here is my OCSP Config :
Finally configure OCSP Stapling profile on my SSL profile
So, here is the problem :
`openssl s_client -connect mysite.com.com:443 -tlsextdebug -status | grep -i "ocsp response" -B 5 -A 10
depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2
verify return:1
depth=0 C = FR, ST = HAUTS-DE-SEINE, L = BOULOGNE-BILLANCOURT, O = Mycompany, CN = *.mysite.com
verify return:1
CONNECTED(00000003)
TLS server extension "renegotiation info" (id=65281), len=1
0001 -
OCSP response: no response sent
---
Certificate chain
0 s:/C=FR/ST=HAUTS-DE-SEINE/L=BOULOGNE-BILLANCOURT/O=Mycompany SA/CN=*.mysite.com
i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2
1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2
i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFXjCCBEagAwIBAgIMC5i5tRV4nZMVggsYMA0GCSqGSIb3DQEBCwUAMGYxCzAJ
The problem is than no DNS request is made by F5 (tcpdump is empty). And no access request is made to ocsp2.globalsign.com
F5 is in version 12.1.1 build 2
As anyone to try this with Globalsign ?
Thanks a lot or your help
- Kevin_Stewart
Employee
Did you also follow this?
K75106155: Configuring OCSP stapling (13.x)
And do you have a gateway route on the BIG-IP?
- Kevin_Stewart
Employee
- Kevin_Stewart
Employee
When you created the DNS Resolver, did you create a Forward Zone for "."? It's a little hard to see in the screenshots, but the DNS Resolver is pretty much useless without it.
This sounds more like a routing or DNS issue than anything else, especially if it's not even attempting to request the OCSP status.
- Kevin_Stewart
Employee
Can you send a screenshot of your OCSP Stapling config, or describe how you've configured it?
- Kevin_Stewart
Employee
Okay, so maybe two things:
Trusted Certificate Authorities : p_ssl_ocsp_inter_ca --> Certificate who contain Intermediade Globalsign Certificate
This needs to be the complete CA chain, not just the immediate CA signer.
Clock Skew : 300s
Can you also verify that your time is in sync?
- Kevin_Stewart
Employee
You can use ssldump to determine if stapling is actually happening.
ssldump -AdNn -i [client side VLAN] port 443 [and any other filters]
You'll see the status_request message in the Client Hello, and if the server supports it, a stapled response in Certificate Status. And compare this to a known-good stapling site like https://www.bing.com.
If you do see stapling transactions, it could be that Firefox (or SSLLabs) doesn't specifically trust the signer of your stapled response.
- Stanislas_Piro2
Cumulonimbus
Hi Kevin,
This is an interesting thread... i already tried to make it work but didn't spend much time to troubleshoot.
I have a question about the best configuration to make it work.
If we have following certificate tree:
-
RootCA
-
IntermediateCA1
-
IntermediateCA2
- ServerCA
-
IntermediateCA2
-
IntermediateCA1
In clientSSL profile, I configure these certificates:
Cert
-----BEGIN CERTIFICATE----- ServerCA Base64 encoded -----END CERTIFICATE-----
Chain (not including Root CA certificate)
-----BEGIN CERTIFICATE----- IntermediateCA2 Base64 encoded -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- IntermediateCA1 Base64 encoded -----END CERTIFICATE-----
What certificate must be set in OCSP Trusted Certificate Authorities and Trusted Responders?
-
RootCA
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com