508467 - libpkix ocsp checker should use "date" argument to obtain the time for cert validity verification

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Alexei Volkov]

Attachment: Patch v1: use supplied time argument for validity check

pkix_pl_OcspResponse_GetStatusForCert verifies time at time provided by PR_Now(). pkix_OcspChecker_CheckLocal does not use supplied PKIX_PL_Date argument when it checks cached cert status.

With this bug, any revoked cert will be reported as invalid at any time in the past.

Comment 1

[Julien Pierre]

It's interesting that the revocationTime in the OCSP response is required, but it's not required in CRL entries (it's an optional entry extension).
Of course there is no "query time" in the OCSP request, implicitly OCSP is only supposed to verify certs as of the current time.

When verifying certs in the past, if the current time is later than the cert's notAfter date, we don't know if a "good" response from the responder really means much.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 392646 [details] [diff] [review]
Patch v1: use supplied time argument for validity check

r+=nelson with one necessary change.

>@@ -970,10 +970,12 @@ PKIX_Error *
> pkix_pl_OcspResponse_GetStatusForCert(

>         void *plContext)
> {
>+        int64 time = 0;

That must be a PRTime, not an int64.

Comment 3

[Alexei Volkov]

Patch v1 committed with the requested change.