Run a OCSP responder¶
OCSP, or the Online Certificate Status Protocol provides a second method (besides CRLs) for a client to find out if a certificate has been revoked.
Configure OCSP with django-ca¶
If you have (correctly) configured a CA_DEFAULT_HOSTNAME and setup the webserver under that URL, you do not have to configure anything to run an OCSP responder.
To run the responder you only need to create OCSP responder keys/certificates using a manage.py command:
$ python manage.py regenerate_ocsp_keys
Note that you need to pass a password if you have a CA where the private key is encrypted. If you have only some CAs with a password, or you use different passwords, you’ll have to generate keys individually:
$ python manage.py list_cas
11:22:33 - CA with password foo
44:55:66 - CA with password bar
$ python manage.py regenerate_ocsp_keys --password foo 11:22:33
$ python manage.py regenerate_ocsp_keys --password bar 44:55:66
Manual setup¶
django-ca provides the generic view OCSPView
for an OCSP service for your
certificate authorities. The setup involves:
Create an OCSP responser certificate¶
To run an OCSP responder, you first need a certificate with some special properties. Luckily, django-ca has a profile predefined for you:
$ openssl genrsa -out ocsp.key 4096
$ openssl req -new -key ocsp.key -out ocsp.csr -utf8 -batch
$ python manage.py sign_cert --csr=ocsp.csr --out=ocsp.pem \
> --subject /CN=ocsp.example.com --ocsp
Warning
The CommonName in the certificates subject must match the domain where you host your django-ca installation.
Configure generic views¶
The final step in configuring an OCSP responder for the CA is configuring the HTTP endpoint. If
you’ve installed django-ca as a full project or include django_ca.urls
in your root URL config,
configure the CA_OCSP_URLS
setting. It’s a dictionary configuring instances of
OCSPView
. Keys become part of the URL pattern, the value is a
dictionary for the arguments of the view. For example:
CA_OCSP_URLS = {
'root-ca': {
'responder_key': '/usr/share/django-ca/ocsp.key',
'responder_cert': '/usr/share/django-ca/ocsp.pem',
# optional: The name or serial of the CA. By default, the dictionary key ("Root CA" in
# this example is assumed to be the CA name or serial.
#'ca': '34:D6:02:B5:B8:27:4F:51:9A:16:0C:B8:56:B7:79:3F',
# optional: How long OCSP responses are valid
#'expires': 3600,
},
# This URL can be added to any intermediate CA using the --ca-ocsp-url parameter
'intermediate-ca': {
# Dictionary key is not the name of the root CA, so we pass a serial instead:
'ca': '34:D6:02:B5:B8:27:4F:51:9A:16:0C:B8:56:B7:79:3F',
'responder_key': '/usr/share/django-ca/ocsp.key',
'responder_cert': '/usr/share/django-ca/ocsp.pem',
# optional: This URL serves OCSP responses for Child CAs, not signed enduser certs:
#'ca_ocsp': True,
}
}
This would mean that your OCSP responder would be located at /django_ca/ocsp/root-ca/
at whatever
domain you have configured your WSGI daemon. If you’re using your own URL configuration, pass the
same parameters to the as_view()
method.
-
class
django_ca.views.
OCSPBaseView
(**kwargs)[source]¶ View to provide an OCSP responder.
django-ca currently provides two OCSP implementations, one using cryptography>=2.4 and one using oscrypto for older versions of cryptography that do not support OCSP. This is a base view that provides some generic settings and common functions to both implementations.
Note that providing the responder key or certificate using an absolute path is deprecated for the Django file storage API. Please see Update to 1.12.0 or later for more information.
-
ca
= None¶ The name or serial of your Certificate Authority.
-
ca_ocsp
= False¶ If set to
True
, validate child CAs instead.
-
expires
= 600¶ Time in seconds that the responses remain valid. The default is 600 seconds or ten minutes.
-
responder_cert
= None¶ Public key of the responder.
This may either be:
- A relative path used by CA_FILE_STORAGE
- Deprecated: An absolute path on the local filesystem
- A serial of a certificate as stored in the database
- The PEM of the certificate as string
- A loaded
Certificate
-
responder_key
= None¶ Private key used for signing OCSP responses. Either a relative path used by CA_FILE_STORAGE or (deprecated) an absolute path on the local filesystem.
-
Add OCSP URL to new certificates¶
To include the URL to an OCSP service to newly issued certificates (you cannot add it to already issued certificates, obviously), either set it in the admin interface or via the command line:
$ python manage.py list_cas
34:D6:02:B5:B8:27:4F:51:9A:16:0C:B8:56:B7:79:3F - Root CA
$ python manage.py edit_ca --ocsp-url=http://ocsp.example.com/django_ca/ocsp/root-ca/ \
> 34:D6:02:B5:B8:27:4F:51:9A:16:0C:B8:56:B7:79:3F
Run an OCSP responser with openssl ocsp
¶
OpenSSL ships with the openssl ocsp
command that allows you to run an OCSP
responser, but note that the manpage says “only useful for test and
demonstration purposes”.
To use the command, generate an index:
$ python manage.py dump_ocsp_index ocsp.index
OpenSSL itself allows you to run an OCSP responder with this command:
$ openssl ocsp -index ocsp.index -port 8888 -rsigner ocsp.pem \
> -rkey ocsp.example.com.key -CA files/ca.crt -text