now even I am confused with what you're saying as your domain also has OCSP No Check listed and from what I read most delegate certs will also list OCSP No Check as well.
I have very basic knowledge in cryptography, so anyone please correct me if I'm wrong. From my understanding, X509 (version 3) is just a standard for public keys and has optional extensions. The extensions inform a specific usage of the certificate, like basic constraints, key usage, identifier, etc. In our case,
OCSP (Online Certificate Status Protocol) No Check inform what the client MUST do in case the certificate is revoked. Since there are no directives, nothing is done. A better example on my certificates, the
Extended Key Usage tells clients that is important to perform TLS Web Server Authentication and OCSP Signing, but does not say anything about TLS Web Client Authentication, so the client (i.e browser) can do whatever it likes when it comes the time to deal with public keys.
Let's compare the 2 certificates:
Code:
$ openssl s_client -connect axivo.com:443 -status -tls1_2
...
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Key Usage: critical
Digital Signature, Non Repudiation
X509v3 Extended Key Usage:
TLS Web Server Authentication, OCSP Signing
X509v3 Subject Key Identifier:
1A:6E:28:0A:41:4B:25:46:8E:5B:42:4D:B5:6B:9D:F3:B4:B4:EF:9D
X509v3 Authority Key Identifier:
keyid:49:4B:52:27:D1:1B:BC:F2:A1:21:6A:62:7B:51:42:7A:8A:D7:D5:56
OCSP No Check:
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.starfieldtech.com/starfieldextendedissuing.crl
X509v3 Certificate Policies:
Policy: 2.16.840.1.114414.1.7.23.1
CPS: http://certs.starfieldtech.com/repository/
...
$ openssl s_client -connect phcorner.net:443 -status -tls1_2
...
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Key Encipherment, Key Agreement
X509v3 Extended Key Usage:
OCSP Signing, OCSP No Check
X509v3 Subject Key Identifier:
45:E0:A3:66:95:41:4C:5D:D4:49:BC:00:E3:3C:DC:DB:D2:34:3E:17
X509v3 Authority Key Identifier:
keyid:EB:42:34:D0:98:B0:AB:9F:F4:1B:6B:08:F7:CC:64:2E:EF:0E:2C:45
X509v3 Issuer Alternative Name:
URI:http://www.startssl.com/
...
For phcorner.net, we have specific
Extended Key Usage instructions: perform OCSP signing but don't perform OCSP verification. Further more,
OCSP No Check section is missing due to the previous extension conditions.
This is where I'm not sure: what happens with the client when the above conditions are not met? If anyone has some experience in this area, please let us know. I believe the
ssl_stapling_verify directive in Nginx is directly related to extended key use. If
OCSP Signing is missing, no real verification is performed?
