Home / server / Questions / 1078886
Accepted
StanTastic
Asked: 2021-09-29 02:47:36 +0800 CST

Check OCSP on Linux with GET method

  • 772

I want to verify operation of Microsoft OCSP server from Linux. I tried using OpenSSL, but it always returns:

Error querying OCSP responder 140643157128320:error:27076072:OCSP routines:parse_http_line1:server response error:../crypto/ocsp/ocsp_ht.c:260:Code=405,Reason=Method Not Allowed

I checked on the server side and noticed that OpenSSL uses POST method, as opposed to GET method used by certutil (which works fine):

# certutil Request
2021-09-28 10:26:51 10.11.12.13 GET /ocsp/<OCSP request> - 80 - 10.11.12.14 Microsoft-CryptoAPI/10.0 - 200 0 0 4583
# OpenSSL Request
2021-09-28 10:26:51 10.11.12.13 POST / - 80 - 10.11.12.15 - - 405 0 1 5991

Seems that OpenSSL can't be forced to use GET instead of post, but perhaps there's some other utility?

Or conversely, is there a method to force MS OCSP responder to work with POST as well?

openssl ocsp

1 Answers

  1. Best Answer

    You need to add the -no_nonce option to OpenSSL.

    Microsoft OCSP server doesn't support nonce in the requests.

    • 2