Uploaded image for project: 'Python Driver'
  1. Python Driver
  2. PYTHON-2147

OCSP callback should use the verified peer certificate chain to find the cert issuer

    XMLWordPrintableJSON

Details

    • Task
    • Status: Closed
    • Major - P3
    • Resolution: Fixed
    • 3.11
    • 3.13, 4.1, 4.0.2
    • TLS/SSL
    • None

    Description

      Our OCSP callback should use the verified peer certificate chain to find the cert issuer. It currently uses the "raw" peer certificate chain sent by the server. This requires a new PyOpenSSL feature to allow inspecting the verified peer cert chain. I've implemented this in:
      https://github.com/pyca/pyopenssl/pull/894

      Attachments

        Issue Links

          is related to

          Task - A task that needs to be done. PYTHON-3132 Bump minimum pyopenssl version req to >=20

          • Minor - P4 - Minor loss of function, or other problem where easy workaround is present.
          • Backlog

          Task - A task that needs to be done. PYTHON-2936 Test Failure - test_validation_with_system_ca_certs macOS + pyOpenSSL

          • Unknown - Priority not determined yet.
          • Closed
          related to

          Task - A task that needs to be done. PYTHON-2093 OCSP Support

          • Major - P3 - Major loss of function.
          • Closed

          Task - A task that needs to be done. PYTHON-2140 Test PyOpenSSL support on macOS

          • Major - P3 - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. PYTHON-2144 Test OCSP support on macOS and Windows

          • Major - P3 - Major loss of function.
          • Closed

          Activity

            People

              shane.harvey@mongodb.com Shane Harvey
              shane.harvey@mongodb.com Shane Harvey
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: