Add OCSP support to ssl module

[tiran]

BPO	17123
Nosy	@warsaw, @birkenfeld, @jcea, @pitrou, @tiran, @benjaminp, @phmc, @dkg, @ShaneHarvey

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = None
created_at = <Date 2013-02-04.16:14:32.770>
labels = ['extension-modules', 'expert-SSL', 'type-feature', '3.8']
title = 'Add OCSP support to ssl module'
updated_at = <Date 2019-10-17.01:46:40.648>
user = 'https://github.com/tiran'

bugs.python.org fields:

activity = <Date 2019-10-17.01:46:40.648>
actor = 'dkg'
assignee = 'christian.heimes'
closed = False
closed_date = None
closer = None
components = ['Extension Modules', 'SSL']
creation = <Date 2013-02-04.16:14:32.770>
creator = 'christian.heimes'
dependencies = []
files = []
hgrepos = []
issue_num = 17123
keywords = []
message_count = 10.0
messages = ['181341', '181353', '181354', '181372', '200763', '275045', '354292', '354306', '354756', '354825']
nosy_count = 11.0
nosy_names = ['barry', 'georg.brandl', 'jcea', 'pitrou', 'christian.heimes', 'benjamin.peterson', 'Arfrever', 'pconnell', 'dkg', 'behackett', 'ShaneHarvey']
pr_nums = []
priority = 'normal'
resolution = None
stage = 'needs patch'
status = 'open'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue17123'
versions = ['Python 3.8']

[tiran]

Python's ssl module doesn't support OCSP [1]. The example code at [2] doesn't look too complicated. We should consider OCSP at least for 3.4 and may want to backport it to older versions to prevent MITM attacks on PyPI downloads.

[1]http://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol)
[2] http://etutorials.org/Programming/secure+programming/Chapter+10.+Public+Key+Infrastructure/10.12+Checking+Revocation+Status+via+OCSP+with+OpenSSL/

[pitrou]

Can you explain how OCSP helps prevent MITM attacks?

----- Mail original -----

De: "Christian Heimes" <report@bugs.python.org>
À: pitrou@free.fr
Envoyé: Lundi 4 Février 2013 17:14:32
Objet: [bpo-17123] Add OCSP support to ssl module

New submission from Christian Heimes:

Python's ssl module doesn't support OCSP [1]. The example code at [2]
doesn't look too complicated. We should consider OCSP at least for
3.4 and may want to backport it to older versions to prevent MITM
attacks on PyPI downloads.

[tiran]

OCSP can prevent MITM attacks when the private server cert or CA cert got compromised or stolen somehow.

[pitrou]

Christian, I really don't agree this should be a release blocker, and especially not for bugfix branches.

[tiran]

I won't have time for a proper implementation for 3.4. Defer to 3.5

[tiran]

I'll add OCSP stapling verification to 3.7.