vanbroup · January 20, 2024 10:54 · vanbroup · Jul 6, 2020 · vanbroup · Jul 6, 2020
diff --git a/ca-hierarchy-ocsp-test.go b/ca-hierarchy-ocsp-test.go
 // certutil -urlcache * delete
 // certutil -verify -user -urlfetch "Server Certificate.cer"
 package main

 import (
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"encoding/base64"
 	"fmt"
 	"io"
 	"io/ioutil"
 	"log"
 	"math/big"
 	"net/http"
 	"net/url"
 	"path"
 	"time"

 	"golang.org/x/crypto/ocsp"
 )

 func main() {
 	// Self signed root CA
 	rootCATemplate := &x509.Certificate{
 		SerialNumber: big.NewInt(time.Now().UnixNano()),
 		Subject: pkix.Name{
 			CommonName: "Root",
 		},
 		NotBefore:             time.Now(),
 		NotAfter:              time.Now().AddDate(25, 0, 0),
 		IsCA:                  true,
 		BasicConstraintsValid: true,
 		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
 	}

 	rootKey, rootCert, err := createAndIssue(rootCATemplate, nil, nil)
 	if err != nil {
 		panic(err)
 	}

 	// ICA
 	iCATemplate := &x509.Certificate{
 		SerialNumber: big.NewInt(time.Now().UnixNano()),
 		Subject: pkix.Name{
 			CommonName: "ICA",
 		},
 		NotBefore:             time.Now(),
 		NotAfter:              time.Now().AddDate(10, 0, 0),
 		IsCA:                  true,
 		BasicConstraintsValid: true,
 		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
 		OCSPServer:            []string{"http://localhost:8080"},
 	}

 	icaKey, icaCert, err := createAndIssue(iCATemplate, rootCert, rootKey)
 	if err != nil {
 		panic(err)
 	}

 	icaOCSPResponse, err := createOCSP(rootKey, rootCert, icaCert)
 	if err != nil {
 		panic(err)
 	}

 	// ICA2
 	iCA2Template := &x509.Certificate{
 		SerialNumber: big.NewInt(time.Now().UnixNano()),
 		Subject: pkix.Name{
 			CommonName: "ICA 2",
 		},
 		NotBefore:             time.Now(),
 		NotAfter:              time.Now().AddDate(10, 0, 0),
 		IsCA:                  true,
 		BasicConstraintsValid: true,
 		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageOCSPSigning},
 		OCSPServer:            []string{"http://localhost:8080"},
 	}

 	ica2Key, ica2Cert, err := createAndIssue(iCA2Template, rootCert, rootKey)
 	if err != nil {
 		panic(err)
 	}

 	ica2OCSPResponse, err := createOCSP(rootKey, rootCert, ica2Cert)
 	if err != nil {
 		panic(err)
 	}

 	// overrull the OCSP response
 	icaOCSPResponse, err = ocsp.CreateResponse(rootCert, ica2Cert, ocsp.Response{
 		Status:           ocsp.Revoked,
 		SerialNumber:     icaCert.SerialNumber,
 		ThisUpdate:       time.Now(),
 		NextUpdate:       time.Now().AddDate(1, 0, 0),
 		RevokedAt:        time.Now(),
 		RevocationReason: ocsp.KeyCompromise,
 		Certificate:      ica2Cert,
 	}, ica2Key)
 	if err != nil {
 		panic(err)
 	}

 	// Server certificate
 	serverTemplate := &x509.Certificate{
 		SerialNumber: big.NewInt(time.Now().UnixNano()),
 		Subject: pkix.Name{
 			CommonName: "Server Certificate",
 		},
 		DNSNames:    []string{"localhost"},
 		NotBefore:   time.Now(),
 		NotAfter:    time.Now().AddDate(0, 3, 0),
 		KeyUsage:    x509.KeyUsageDigitalSignature,
 		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
 		OCSPServer:  []string{"http://localhost:8080"},
 	}

 	serverKey, serverCert, err := createAndIssue(serverTemplate, icaCert, icaKey)
 	if err != nil {
 		panic(err)
 	}

 	serverOCSPResponse, err := createOCSP(icaKey, icaCert, serverCert)
 	if err != nil {
 		panic(err)
 	}

 	ocspResponses := make(map[string][]byte)
 	ocspResponses[icaCert.SerialNumber.String()] = icaOCSPResponse
 	ocspResponses[ica2Cert.SerialNumber.String()] = ica2OCSPResponse
 	ocspResponses[serverCert.SerialNumber.String()] = serverOCSPResponse

 	// Verify
 	rootPool := x509.NewCertPool()
 	rootPool.AddCert(rootCert)

 	icaPool := x509.NewCertPool()
 	icaPool.AddCert(icaCert)

 	_, err = icaCert.Verify(x509.VerifyOptions{
 		Roots:         rootPool,
 		Intermediates: icaPool,
 		CurrentTime:   time.Now(),
 		KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageOCSPSigning},
 	})
 	if err != nil {
 		log.Println("Verify error:", err)
 	} else {
 		log.Println("Verify OK")
 	}

 	go startWebserver(serverKey, serverCert, icaCert)
 	startOCSPServer(ocspResponses)

 }

 func createOCSP(icaKey crypto.Signer, icaCert, cert *x509.Certificate) ([]byte, error) {
 	// OCSP Signing Certificate
 	ocspTemplate := &x509.Certificate{
 		SerialNumber: big.NewInt(3),
 		Subject: pkix.Name{
 			CommonName: "Delegated OCSP signing certificate for " + icaCert.Subject.CommonName,
 		},
 		NotBefore:   time.Now(),
 		NotAfter:    time.Now().AddDate(0, 3, 0),
 		KeyUsage:    x509.KeyUsageDigitalSignature,
 		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageOCSPSigning},
 	}

 	ocspTemplate.ExtraExtensions = append(ocspTemplate.ExtraExtensions, pkix.Extension{
 		Id:       asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1, 5},
 		Value:    []byte{asn1.TagNull, 0},
 		Critical: false,
 	})

 	ocspKey, ocspCert, err := createAndIssue(ocspTemplate, icaCert, icaKey)
 	if err != nil {
 		return nil, err
 	}

 	// Create OCSP response
 	ocspResponse, err := ocsp.CreateResponse(icaCert, ocspCert, ocsp.Response{
 		Status:       ocsp.Good,
 		SerialNumber: cert.SerialNumber,
 		ThisUpdate:   time.Now(),
 		NextUpdate:   time.Now().AddDate(1, 0, 0),
 		Certificate:  ocspCert,
 	}, ocspKey)
 	if err != nil {
 		return nil, err
 	}

 	return ocspResponse, nil
 }

 func startWebserver(key crypto.PrivateKey, cert, issuer *x509.Certificate) {
 	serverHandler := func(w http.ResponseWriter, req *http.Request) {
 		log.Printf("HTTPS | %s [%s] %s\n", req.UserAgent(), req.Method, req.RequestURI)
 		io.WriteString(w, "Hello, world!\n")
 	}
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", serverHandler)

 	cfg := &tls.Config{Certificates: []tls.Certificate{{
 		Certificate: [][]byte{cert.Raw, issuer.Raw},
 		PrivateKey:  key,
 	}}}
 	srv := &http.Server{
 		Addr:         ":8443",
 		TLSConfig:    cfg,
 		ReadTimeout:  time.Minute,
 		WriteTimeout: time.Minute,
 		Handler:      mux,
 	}
 	log.Println("Starting webserver on port 8443")
 	log.Fatal(srv.ListenAndServeTLS("", ""))
 }

 func startOCSPServer(response map[string][]byte) {
 	ocspHandler := func(w http.ResponseWriter, req *http.Request) {
 		log.Printf("OCSP | %s [%s] %s\n", req.UserAgent(), req.Method, req.RequestURI)

 		var err error
 		var request []byte
 		switch req.Method {
 		case http.MethodPost:
 			request, err = ioutil.ReadAll(req.Body)
 			if err != nil {
 				log.Println(err)
 				return
 			}
 		case http.MethodGet:
 			requestBase64, err := url.QueryUnescape(path.Base(req.URL.RawPath))
 			if err != nil {
 				log.Println(err)
 				return
 			}
 			request, err = base64.StdEncoding.DecodeString(requestBase64)
 			if err != nil {
 				log.Println(err)
 				return
 			}
 		}

 		or, err := ocsp.ParseRequest(request)
 		if err != nil {
 			log.Println(err)
 			return
 		}

 		if _, ok := response[or.SerialNumber.String()]; !ok {
 			log.Println("OCSP | Unkown serial number:", or.SerialNumber)
 			return
 		}

 		w.Header().Set("Content-Type", "application/ocsp-response")
 		w.Write(response[or.SerialNumber.String()])
 		log.Println("OCSP | Request served for serial number:", or.SerialNumber.String())
 	}
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", ocspHandler)

 	srv := &http.Server{
 		Addr:         ":8080",
 		ReadTimeout:  time.Minute,
 		WriteTimeout: time.Minute,
 		Handler:      mux,
 	}
 	log.Fatal(srv.ListenAndServe())
 }

 func createAndIssue(template, issuerCert *x509.Certificate, issuerKey crypto.Signer) (crypto.Signer, *x509.Certificate, error) {
 	private, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		panic(err)
 	}

 	if issuerKey == nil {
 		issuerKey = private
 		issuerCert = template
 	}

 	rawCert, err := x509.CreateCertificate(rand.Reader, template, issuerCert, private.Public(), issuerKey)
 	if err != nil {
 		fmt.Println(err)
 		return nil, nil, err
 	}

 	cert, err := x509.ParseCertificate(rawCert)
 	if err != nil {
 		return nil, nil, err
 	}

 	ioutil.WriteFile(cert.Subject.CommonName+".cer", rawCert, 0644)

 	fmt.Printf("Issued certificate:\n\tSubject: %s\n\tIssuer: %s\n\n", cert.Subject, cert.Issuer)

 	return private, cert, nil
 }
	// certutil -urlcache * delete
	// certutil -verify -user -urlfetch "Server Certificate.cer"
	package main

	import (
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"encoding/base64"
	"fmt"
	"io"
	"io/ioutil"
	"log"
	"math/big"
	"net/http"
	"net/url"
	"path"
	"time"

	"golang.org/x/crypto/ocsp"
	)

	func main() {
	// Self signed root CA
	rootCATemplate := &x509.Certificate{
	SerialNumber: big.NewInt(time.Now().UnixNano()),
	Subject: pkix.Name{
	CommonName: "Root",
	},
	NotBefore: time.Now(),
	NotAfter: time.Now().AddDate(25, 0, 0),
	IsCA: true,
	BasicConstraintsValid: true,
	KeyUsage: x509.KeyUsageCertSign \| x509.KeyUsageCRLSign,
	}

	rootKey, rootCert, err := createAndIssue(rootCATemplate, nil, nil)
	if err != nil {
	panic(err)
	}

	// ICA
	iCATemplate := &x509.Certificate{
	SerialNumber: big.NewInt(time.Now().UnixNano()),
	Subject: pkix.Name{
	CommonName: "ICA",
	},
	NotBefore: time.Now(),
	NotAfter: time.Now().AddDate(10, 0, 0),
	IsCA: true,
	BasicConstraintsValid: true,
	KeyUsage: x509.KeyUsageCertSign \| x509.KeyUsageCRLSign,
	ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
	OCSPServer: []string{"http://localhost:8080"},
	}

	icaKey, icaCert, err := createAndIssue(iCATemplate, rootCert, rootKey)
	if err != nil {
	panic(err)
	}

	icaOCSPResponse, err := createOCSP(rootKey, rootCert, icaCert)
	if err != nil {
	panic(err)
	}

	// ICA2
	iCA2Template := &x509.Certificate{
	SerialNumber: big.NewInt(time.Now().UnixNano()),
	Subject: pkix.Name{
	CommonName: "ICA 2",
	},
	NotBefore: time.Now(),
	NotAfter: time.Now().AddDate(10, 0, 0),
	IsCA: true,
	BasicConstraintsValid: true,
	KeyUsage: x509.KeyUsageCertSign \| x509.KeyUsageCRLSign,
	ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageOCSPSigning},
	OCSPServer: []string{"http://localhost:8080"},
	}

	ica2Key, ica2Cert, err := createAndIssue(iCA2Template, rootCert, rootKey)
	if err != nil {
	panic(err)
	}

	ica2OCSPResponse, err := createOCSP(rootKey, rootCert, ica2Cert)
	if err != nil {
	panic(err)
	}

	// overrull the OCSP response
	icaOCSPResponse, err = ocsp.CreateResponse(rootCert, ica2Cert, ocsp.Response{
	Status: ocsp.Revoked,
	SerialNumber: icaCert.SerialNumber,
	ThisUpdate: time.Now(),
	NextUpdate: time.Now().AddDate(1, 0, 0),
	RevokedAt: time.Now(),
	RevocationReason: ocsp.KeyCompromise,
	Certificate: ica2Cert,
	}, ica2Key)
	if err != nil {
	panic(err)
	}

	// Server certificate
	serverTemplate := &x509.Certificate{
	SerialNumber: big.NewInt(time.Now().UnixNano()),
	Subject: pkix.Name{
	CommonName: "Server Certificate",
	},
	DNSNames: []string{"localhost"},
	NotBefore: time.Now(),
	NotAfter: time.Now().AddDate(0, 3, 0),
	KeyUsage: x509.KeyUsageDigitalSignature,
	ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
	OCSPServer: []string{"http://localhost:8080"},
	}

	serverKey, serverCert, err := createAndIssue(serverTemplate, icaCert, icaKey)
	if err != nil {
	panic(err)
	}

	serverOCSPResponse, err := createOCSP(icaKey, icaCert, serverCert)
	if err != nil {
	panic(err)
	}

	ocspResponses := make(map[string][]byte)
	ocspResponses[icaCert.SerialNumber.String()] = icaOCSPResponse
	ocspResponses[ica2Cert.SerialNumber.String()] = ica2OCSPResponse
	ocspResponses[serverCert.SerialNumber.String()] = serverOCSPResponse

	// Verify
	rootPool := x509.NewCertPool()
	rootPool.AddCert(rootCert)

	icaPool := x509.NewCertPool()
	icaPool.AddCert(icaCert)

	_, err = icaCert.Verify(x509.VerifyOptions{
	Roots: rootPool,
	Intermediates: icaPool,
	CurrentTime: time.Now(),
	KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageOCSPSigning},
	})
	if err != nil {
	log.Println("Verify error:", err)
	} else {
	log.Println("Verify OK")
	}

	go startWebserver(serverKey, serverCert, icaCert)
	startOCSPServer(ocspResponses)

	}

	func createOCSP(icaKey crypto.Signer, icaCert, cert *x509.Certificate) ([]byte, error) {
	// OCSP Signing Certificate
	ocspTemplate := &x509.Certificate{
	SerialNumber: big.NewInt(3),
	Subject: pkix.Name{
	CommonName: "Delegated OCSP signing certificate for " + icaCert.Subject.CommonName,
	},
	NotBefore: time.Now(),
	NotAfter: time.Now().AddDate(0, 3, 0),
	KeyUsage: x509.KeyUsageDigitalSignature,
	ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageOCSPSigning},
	}

	ocspTemplate.ExtraExtensions = append(ocspTemplate.ExtraExtensions, pkix.Extension{
	Id: asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1, 5},
	Value: []byte{asn1.TagNull, 0},
	Critical: false,
	})

	ocspKey, ocspCert, err := createAndIssue(ocspTemplate, icaCert, icaKey)
	if err != nil {
	return nil, err
	}

	// Create OCSP response
	ocspResponse, err := ocsp.CreateResponse(icaCert, ocspCert, ocsp.Response{
	Status: ocsp.Good,
	SerialNumber: cert.SerialNumber,
	ThisUpdate: time.Now(),
	NextUpdate: time.Now().AddDate(1, 0, 0),
	Certificate: ocspCert,
	}, ocspKey)
	if err != nil {
	return nil, err
	}

	return ocspResponse, nil
	}

	func startWebserver(key crypto.PrivateKey, cert, issuer *x509.Certificate) {
	serverHandler := func(w http.ResponseWriter, req *http.Request) {
	log.Printf("HTTPS \| %s [%s] %s\n", req.UserAgent(), req.Method, req.RequestURI)
	io.WriteString(w, "Hello, world!\n")
	}
	mux := http.NewServeMux()
	mux.HandleFunc("/", serverHandler)

	cfg := &tls.Config{Certificates: []tls.Certificate{{
	Certificate: [][]byte{cert.Raw, issuer.Raw},
	PrivateKey: key,
	}}}
	srv := &http.Server{
	Addr: ":8443",
	TLSConfig: cfg,
	ReadTimeout: time.Minute,
	WriteTimeout: time.Minute,
	Handler: mux,
	}
	log.Println("Starting webserver on port 8443")
	log.Fatal(srv.ListenAndServeTLS("", ""))
	}

	func startOCSPServer(response map[string][]byte) {
	ocspHandler := func(w http.ResponseWriter, req *http.Request) {
	log.Printf("OCSP \| %s [%s] %s\n", req.UserAgent(), req.Method, req.RequestURI)

	var err error
	var request []byte
	switch req.Method {
	case http.MethodPost:
	request, err = ioutil.ReadAll(req.Body)
	if err != nil {
	log.Println(err)
	return
	}
	case http.MethodGet:
	requestBase64, err := url.QueryUnescape(path.Base(req.URL.RawPath))
	if err != nil {
	log.Println(err)
	return
	}
	request, err = base64.StdEncoding.DecodeString(requestBase64)
	if err != nil {
	log.Println(err)
	return
	}
	}

	or, err := ocsp.ParseRequest(request)
	if err != nil {
	log.Println(err)
	return
	}

	if _, ok := response[or.SerialNumber.String()]; !ok {
	log.Println("OCSP \| Unkown serial number:", or.SerialNumber)
	return
	}

	w.Header().Set("Content-Type", "application/ocsp-response")
	w.Write(response[or.SerialNumber.String()])
	log.Println("OCSP \| Request served for serial number:", or.SerialNumber.String())
	}
	mux := http.NewServeMux()
	mux.HandleFunc("/", ocspHandler)

	srv := &http.Server{
	Addr: ":8080",
	ReadTimeout: time.Minute,
	WriteTimeout: time.Minute,
	Handler: mux,
	}
	log.Fatal(srv.ListenAndServe())
	}

	func createAndIssue(template, issuerCert x509.Certificate, issuerKey crypto.Signer) (crypto.Signer, x509.Certificate, error) {
	private, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
	panic(err)
	}

	if issuerKey == nil {
	issuerKey = private
	issuerCert = template
	}

	rawCert, err := x509.CreateCertificate(rand.Reader, template, issuerCert, private.Public(), issuerKey)
	if err != nil {
	fmt.Println(err)
	return nil, nil, err
	}

	cert, err := x509.ParseCertificate(rawCert)
	if err != nil {
	return nil, nil, err
	}

	ioutil.WriteFile(cert.Subject.CommonName+".cer", rawCert, 0644)

	fmt.Printf("Issued certificate:\n\tSubject: %s\n\tIssuer: %s\n\n", cert.Subject, cert.Issuer)

	return private, cert, nil
	}