OCSP requests received with cert=issuer=null when server started with PFX

[djphoenix]

Test script: https://git.phoenix.dj/snippets/6
Place it into folder that contains:

1. cer.cer: certificate that contains OCSP responder address
2. cer.key: keyfile for certificate
3. ca.cer: certificate issuer
4. cer.pfx: PFX with certificate, ca and key (openssl pkcs12 -export -in cer.cer -inkey cer.key -certfile ca.cer -out cer.pfx -password pass:)

Then run node ocsptest.js
On work PC (Mac OS X EI Capitan, homebrew version):

$ node ocsptest.js 
Node version: v4.1.1 

--- Testing CER+KEY ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: false, issuer: false }
closing...

--- Testing PFX ---
OCSP request { cert: false, issuer: false }
OCSP request { cert: false, issuer: false }
closing...

--- Testing PFX+SNICRT ---
OCSP request { cert: false, issuer: false }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNIPFX ---
OCSP request { cert: false, issuer: false }
SNI 127.0.0.1
OCSP request { cert: false, issuer: false }
closing...

Done

On my server (Debian GNU/Linux 8, deb.nodesource.com/node_4.x):

$ node ocsptest.js 
Node version: v4.2.2 
... exactly same

VMware (Debian GNU/Linux 8, deb.nodesource.com/node_5.x):

$ node ocsptest.js 
Node version: v5.1.0 
... exactly same

[mscdex]

/cc @nodejs/crypto

[indutny]

Confirmed, working on a fix.

[indutny]

@djphoenix may I ask you to give a try to this patch, please ? #4165

[djphoenix]

# ~/nodejs/node-v5.1.1/node ocsptest.js 
Node version: v5.1.1 
... same as reference

# ~/nodejs/node-v5.1.1-patched/node ocsptest.js 
Node version: v5.1.1 

--- Testing CER+KEY ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing CER+KEY+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX ---
OCSP request { cert: true, issuer: true }
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNICRT ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

--- Testing PFX+SNIPFX ---
OCSP request { cert: true, issuer: true }
SNI 127.0.0.1
OCSP request { cert: true, issuer: true }
closing...

Done

Perfect work, @indutny!

[djphoenix]

Will fix release for 5.x only, or 4.x too?

[indutny]

@djphoenix 4.x too