Working OCSP Stapling setup with free Wosign Certificate on Nginx

Chinese CA WoSign issues free multi-domain SSL certificates valid for 3 years. You can read some informations on how to get theses free certificates on https://www.ohling.org/blog/2015/02/wosign-free-2y-ssl-certificate.html.
FYI, I received my certificate around 1hour after submission :)

Now, the nginx ssl configuration ! I won’t cover the pure SSL configuration, you can look at mozilla wiki for a “perfect setup”.
Standard procedure, you extract the provided zip, grab the 1_mydomain_bundle.crt and add it to nginx ssl configuration.

I wanted to enable OCSP stapling, for checking the revocation status of X.509 digital certificates on server side.
Basic OCSP checking potentially impairs users’ privacy and slows down browsing, since it requires the client to contact a third party (the CA) to confirm the validity of each certificate that it encounters. With OCSP Stapling, the certificate holder (your servers) queries the OCSP server themselves at regular intervals, obtaining a signed time-stamped OCSP response.
When the site’s visitors attempt to connect to the site, this response is included with the TLS Handshake.

In nginx, the stapling configuration is simple :

ssl_stapling on;
ssl_stapling_verify on;

Then you need to reload nginx. You can now test OCSP response with openssl.

openssl s_client -connect blog.alteroot.org:443 -tls1_2 -tlsextdebug -status

Note: the FIRST client request always has a empty OSCP response, because nginx query the remote OCSP server at the same time. This applies to ALL nginx workers, Nginx uses a per-worker cache of OCSP responses.

Unfortunately, it does not works, and I can see in nginx logs this error :

2015/07/17 11:31:21 [error] 19557#0: OCSP responder sent invalid "Content-Type" header: "text/html" while requesting certificate status, responder: ocsp6.wosign.com

By checking http://ocsp6.wosign.com/ (504 bad gateway), I thought that their OCSP Server was down.
After some investigations, I found this nginx ticket : You need at least Nginx 1.7.4 which fix a bug with uppercase on ngx_escape_uri() !

As I just set up a new server with debian Jessie, I used the default Nginx (1.6.2). So I need to upgrade to 1.8.0 with Dotdeb packages (thanks @gui ;)).

After upgrade to 1.8.0, in Nginx logs :

2015/07/17 11:47:30 [error] 21390#21390: OCSP_basic_verify() failed (SSL: error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:Verify error:unable to get local issuer certificate) while requesting certificate status, responder: ocsp6.wosign.com

Yes ! At least nginx can talk to the OCSP server :)

Now, I need to add “trusted” certificate to Nginx.
You need to “cat” StartCom Certification Authority certificate then Wosign one.
Why Startcom ? Because the WoSign root CA is cross-signed by the StartCom CA so it is trusted by every browsers.

The StartCom Certification Authority certificate (Serial 1, PEM format) : https://ssl-tools.net/certificates/1cf30e1-startcom-certification-authority
And WoSign CA certificates (includes in the 1_mydomain_bundle.crt)

The final ssl_trusted_certificate file :

Now the OCSP check works !

$ openssl s_client -connect blog.alteroot.org:443 -tls1_2 -tlsextdebug -status
[...]
OCSP response: 
======================================
OCSP Response Data:
    OCSP Response Status: successful (0x0)
    Response Type: Basic OCSP Response
    Version: 1 (0x0)
    Responder Id: C = CN, O = WoSign CA Limited, CN = WoSign Free SSL OCSP Responder(G2)
    Produced At: Jul 17 11:12:45 2015 GMT
    Responses:
    Certificate ID:
      Hash Algorithm: sha1
      Issuer Name Hash: A06661F16CBCC23E98BC71914830B85AAA8D0A6B
      Issuer Key Hash: D2A716207CAFD9959EEB430A19F2E0B9740EA8C7
      Serial Number: 5FA7F414BCB7C7374B525EEB4D894072
    Cert Status: good
    This Update: Jul 17 11:12:45 2015 GMT
    Next Update: Jul 19 11:12:45 2015 GMT
[...]

Enjoy :)

Sources: