I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server: /etc/raddb/sites-enabled/tls-cache[114]: Failed to find "cache_ocsp" as a module or policy. /etc/raddb/sites-enabled/tls-cache[114]: Please verify that the configuration exists in /etc/raddb/mods-enabled/cache_ocsp. /etc/raddb/sites-enabled/tls-cache[114]: Failed to parse "cache_ocsp" entry. Has anyone else experienced this problem? Regards Scott
On Nov 25, 2015, at 9:21 AM, Scott Armitage <S.P.Armitage@lboro.ac.uk> wrote:
I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server:
/etc/raddb/sites-enabled/tls-cache[114]: Failed to find "cache_ocsp" as a module or policy. /etc/raddb/sites-enabled/tls-cache[114]: Please verify that the configuration exists in /etc/raddb/mods-enabled/cache_ocsp. /etc/raddb/sites-enabled/tls-cache[114]: Failed to parse "cache_ocsp" entry.
You need mods-available/cache_tls linked to mods-enabled. Looks like the module name was slightly off too, so if you already have a cache_tls file, s/cache_ocsp_session/cache_ocsp/ -Arran
Hi,
Looks like the module name was slightly off too, so if you already have a cache_tls file, s/cache_ocsp_session/cache_ocsp/
..thought so.... which way is the server going to cache_ocsp_session or cache_ocsp (just to keep our config in sync) as the other entry is cache_tls_session not cache_tls........ alan
On Nov 25, 2015, at 9:50 AM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Looks like the module name was slightly off too, so if you already have a cache_tls file, s/cache_ocsp_session/cache_ocsp/
..thought so.... which way is the server going to cache_ocsp_session or cache_ocsp (just to keep our config in sync) as the other entry is cache_tls_session not cache_tls........
Yes but there you're actually caching a TLS session :) I suppose this should be cache_ocsp_response, feel free to send PR if that name is more appealing. -Arran
Hi,
I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server:
/etc/raddb/sites-enabled/tls-cache[114]: Failed to find "cache_ocsp" as a module or policy. /etc/raddb/sites-enabled/tls-cache[114]: Please verify that the configuration exists in /etc/raddb/mods-enabled/cache_ocsp. /etc/raddb/sites-enabled/tls-cache[114]: Failed to parse "cache_ocsp" entry.
is this just a typo..... should be cache_ocsp_session as per "cache cache_ocsp_session" in cache_tls module? alan
On Wed, Nov 25, 2015 at 02:21:16PM +0000, Scott Armitage wrote:
I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server:
I thought the whole point of OCSP was that it was supposed to be a lightweight and quickly updated alternative to CRLs, and therefore caching it doesn't make sense from a security point of view? Though I guess a cache of a couple of hours or so is unlikely to hurt (until the cert is revoked because of a security incident). Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Nov 25, 2015, at 9:40 AM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Wed, Nov 25, 2015 at 02:21:16PM +0000, Scott Armitage wrote:
I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server:
I thought the whole point of OCSP was that it was supposed to be a lightweight and quickly updated alternative to CRLs, and therefore caching it doesn't make sense from a security point of view?
No, it does. The OCSP standard provides a nextUpdate field which indicates the next time data will be available. nextUpdate The time at or before which newer information will be available about the status of the certificate. https://tools.ietf.org/html/rfc6960 (section 2.4). So you can use that as your Cache-TTL. You can also do smarter things if you own all the internal infrastructure like delete cache entries when the status of the certificate changes. This particular feature was added to support a very large commercial deployment of EAP-TLS (1.6M subscribers), which is operating with a single OCSP server instance (it fails open). I have no idea how good OpenSSL's internal OCSP client is, but I wouldn't be surprised if it closed the TCP connection after every request. -Arran
On Wed, Nov 25, 2015 at 09:52:09AM -0500, Arran Cudbard-Bell wrote:
I thought the whole point of OCSP was that it was supposed to be a lightweight and quickly updated alternative to CRLs, and therefore
No, it does. The OCSP standard provides a nextUpdate field which indicates the next time data will be available.
nextUpdate The time at or before which newer information will be
Ah, cool. That does make sense, then.
This particular feature was added to support a very large commercial deployment of EAP-TLS (1.6M subscribers), which is operating with a single OCSP server instance (it fails open).
Yeah, same here but much less clients. Which was why I wrote the "softfail" option :-) Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On Nov 25, 2015, at 10:12 AM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
No, it does. The OCSP standard provides a nextUpdate field which indicates the next time data will be available.
is the server going to come with a tool to view/set/delete cached entries?
Maybe for the internal rbtree, for memcached and redis you can use the standard tools. -Arran
On Nov 25, 2015, at 9:21 AM, Scott Armitage <S.P.Armitage@lboro.ac.uk> wrote:
I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server:
In 3.1, modules are in raddb/mods-available/. So raddb/mods-available/cache_ocsp Alan DeKok.
On Nov 25, 2015, at 10:15 AM, Alan DeKok <aland@deployingradius.com> wrote:
On Nov 25, 2015, at 9:21 AM, Scott Armitage <S.P.Armitage@lboro.ac.uk> wrote:
I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server:
In 3.1, modules are in raddb/mods-available/. So raddb/mods-available/cache_ocsp
No, they're both in cache_tls. -Arran
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Matthew Newton -
Scott Armitage