Add support for revocation checking via OCSP

[nabla-c0d3]

Sample code on how to do it at https://gist.github.com/gattjoe/94dbf531d3d4ef60ca8a2f3663382926

[gattjoe]

I updated my code to support SSLyze 3.0.8, working example at https://gist.github.com/gattjoe/509971b9df8cd088cbb68f6fbbab9949

[nabla-c0d3]

Finally had time to look at this - it looks good and as stated in your email, it would make more sense as a standalone plugin.

[faheel]

@nabla-c0d3 Desn't nassl already support this (implemented in https://github.com/nabla-c0d3/nassl/blob/release/nassl/ocsp_response.py)? I'm also able to see the OCSP response and revocation status when testing for yahoo.com (using python -m sslyze --certinfo yahoo.com --json_out=-):

    ...
    "ocsp_response": {
        "certificate_status": "good",
        "extensions": null,
        "hash_algorithm": "sha1",
        "issuer_key_hash": "5168FF90AF0207753CCCD9656462A212B859723B",
        "issuer_name_hash": "CF26F518FAC97E8F8CB342E01C2F6A109E8E5F0A",
        "next_update": "2020-10-11T14:18:01",
        "produced_at": "2020-10-04T15:03:01",
        "responder_id": "5168FF90AF0207753CCCD9656462A212B859723B",
        "serial_number": "06D754AE96D28371A4DEF60AC211B3E1",
        "status": "SUCCESSFUL",
        "this_update": "2020-10-04T15:03:01",
        "type": "Basic OCSP Response",
        "version": 1
    },
    ...

Is this different from what's expected? I'm confused.

[gattjoe]

@faheel I think the existing functionality built into SSLyze is to check for OCSP responses from the server (if the server is configured to provide one). This is via OCSP stapling. Run the same query above against github.com:

python -m sslyze --certinfo github.com --json_out=- | grep ocsp_response "ocsp_response": null, "ocsp_response_is_trusted": null,

github is not setup with OCSP stapling.

The functionality requested here will ask the OCSP responder from the issuing cert authority for an OCSP status. I wrote a quick python package to do just that until the functionality is built directly into SSLyze, check out https://github.com/MetLife/OCSPChecker.

[faheel]

@gattjoe Got it. Thanks for the clarification!