| Signed through an intermediate without the correct key usage |
| |
| $ openssl ocsp -resp_text -respin <([OCSP RESPONSE]) |
| OCSP Response Data: |
| OCSP Response Status: successful (0x0) |
| Response Type: Basic OCSP Response |
| Version: 1 (0x0) |
| Responder Id: CN = Test False OCSP Signer |
| Produced At: Mar 2 00:00:00 2017 GMT |
| Responses: |
| Certificate ID: |
| Hash Algorithm: sha1 |
| Issuer Name Hash: 449B1C5B31C6E9990966523E49C3F773C024190A |
| Issuer Key Hash: FC6D3387CC3B39B049C755C46DF4395548930BCE |
| Serial Number: 04 |
| Cert Status: good |
| This Update: Mar 1 00:00:00 2017 GMT |
| |
| Signature Algorithm: sha1WithRSAEncryption |
| 77:44:df:f9:65:b0:0b:16:16:87:90:26:3e:e0:1b:ab:b7:c8: |
| b0:97:b0:81:e1:7d:df:5d:17:5c:49:a7:bf:ec:fd:a3:12:cb: |
| ee:35:4d:e2:29:35:06:9d:9c:52:32:aa:6a:7a:39:5a:e8:7d: |
| dd:1c:33:04:78:fb:50:62:b5:d1:1b:4c:75:32:7d:3f:8d:17: |
| 2f:8b:b2:81:db:7a:0e:28:8a:b7:5d:4d:9f:96:8d:e4:f8:2e: |
| bc:d8:96:bb:73:1a:6b:fa:57:59:5a:2f:c5:2c:5e:4c:4e:82: |
| 18:fe:a1:68:fd:99:d9:06:fa:0a:f7:e1:e3:ed:e3:95:c7:04: |
| 97:68 |
| Certificate: |
| Data: |
| Version: 3 (0x2) |
| Serial Number: 3 (0x3) |
| Signature Algorithm: sha1WithRSAEncryption |
| Issuer: CN=Test Intermediate CA |
| Validity |
| Not Before: Jan 1 00:00:00 2017 GMT |
| Not After : Jan 1 00:00:00 2018 GMT |
| Subject: CN=Test False OCSP Signer |
| Subject Public Key Info: |
| Public Key Algorithm: rsaEncryption |
| Public-Key: (1024 bit) |
| Modulus: |
| 00:bf:28:fa:03:ec:a6:42:94:4d:f0:86:5e:7d:bf: |
| 1a:a0:c5:99:4a:4a:43:44:6a:42:d5:bb:ec:b5:1f: |
| 12:44:b1:7a:8a:07:b8:c2:7f:17:27:12:68:6c:48: |
| 8e:6d:2a:e6:17:96:64:71:d4:bf:81:c7:9b:d4:8b: |
| 5f:b6:31:d4:53:50:e6:b2:66:f3:37:38:5a:8c:dd: |
| 79:12:36:c6:c0:c2:85:ab:75:77:5d:97:84:e3:3e: |
| 6c:5a:ad:3c:bf:07:95:f2:0c:e4:e7:f4:2c:95:8e: |
| bd:1c:00:9f:a0:5b:c3:b0:c0:98:d3:5b:38:31:a2: |
| bd:f7:1a:a7:d8:b9:55:62:b1 |
| Exponent: 65537 (0x10001) |
| Signature Algorithm: sha1WithRSAEncryption |
| 77:de:f7:c8:6d:ca:5e:ef:6f:e8:7a:94:aa:a6:05:f4:c1:a8: |
| 4d:8a:8b:f0:c8:fc:6f:0f:c4:55:5b:13:d5:90:31:fb:99:fa: |
| f0:30:81:b4:33:a3:f0:fb:49:8c:bb:a4:64:85:1a:83:48:ca: |
| 78:a9:74:23:b7:60:d2:b4:67:db:10:db:12:a2:d5:1c:9b:17: |
| 7f:3b:69:da:2c:df:8c:4e:aa:a6:19:41:b8:8f:58:af:59:7f: |
| 84:87:d1:08:fb:bb:40:88:db:ea:06:da:94:22:51:64:a7:69: |
| 0b:4b:2a:53:2c:86:d7:72:e7:1f:21:73:e6:b4:2d:25:46:f1: |
| 55:e2 |
| ~~~~~BEGIN CERTIFICATE~~~~~ |
| MIIBuDCCASGgAwIBAgIBAzANBgkqhkiG9w0BAQUFADAfMR0wGwYDVQQDDBRUZXN0 |
| IEludGVybWVkaWF0ZSBDQTAiGA8yMDE3MDEwMTAwMDAwMFoYDzIwMTgwMTAxMDAw |
| MDAwWjAhMR8wHQYDVQQDDBZUZXN0IEZhbHNlIE9DU1AgU2lnbmVyMIGfMA0GCSqG |
| SIb3DQEBAQUAA4GNADCBiQKBgQC/KPoD7KZClE3whl59vxqgxZlKSkNEakLVu+y1 |
| HxJEsXqKB7jCfxcnEmhsSI5tKuYXlmRx1L+Bx5vUi1+2MdRTUOayZvM3OFqM3XkS |
| NsbAwoWrdXddl4TjPmxarTy/B5XyDOTn9CyVjr0cAJ+gW8OwwJjTWzgxor33GqfY |
| uVVisQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHfe98htyl7vb+h6lKqmBfTBqE2K |
| i/DI/G8PxFVbE9WQMfuZ+vAwgbQzo/D7SYy7pGSFGoNIynipdCO3YNK0Z9sQ2xKi |
| 1RybF387ados34xOqqYZQbiPWK9Zf4SH0Qj7u0CI2+oG2pQiUWSnaQtLKlMshtdy |
| 5x8hc+a0LSVG8VXi |
| ~~~~~END CERTIFICATE~~~~~ |
| -----BEGIN OCSP RESPONSE----- |
| MIIC/woBAKCCAvgwggL0BgkrBgEFBQcwAQEEggLlMIIC4TCBh6EjMCExHzAdBgNVBAMMFlRlc3Q |
| gRmFsc2UgT0NTUCBTaWduZXIYDzIwMTcwMzAyMDAwMDAwWjBPME0wODAHBgUrDgMCGgQURJscWz |
| HG6ZkJZlI+ScP3c8AkGQoEFPxtM4fMOzmwScdVxG30OVVIkwvOAgEEgAAYDzIwMTcwMzAxMDAwM |
| DAwWjANBgkqhkiG9w0BAQUFAAOBgQB3RN/5ZbALFhaHkCY+4Burt8iwl7CB4X3fXRdcSae/7P2j |
| EsvuNU3iKTUGnZxSMqpqejla6H3dHDMEePtQYrXRG0x1Mn0/jRcvi7KB23oOKIq3XU2flo3k+C6 |
| 82Ja7cxpr+ldZWi/FLF5MToIY/qFo/ZnZBvoK9+Hj7eOVxwSXaKCCAcAwggG8MIIBuDCCASGgAw |
| IBAgIBAzANBgkqhkiG9w0BAQUFADAfMR0wGwYDVQQDDBRUZXN0IEludGVybWVkaWF0ZSBDQTAiG |
| A8yMDE3MDEwMTAwMDAwMFoYDzIwMTgwMTAxMDAwMDAwWjAhMR8wHQYDVQQDDBZUZXN0IEZhbHNl |
| IE9DU1AgU2lnbmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/KPoD7KZClE3whl59vxq |
| gxZlKSkNEakLVu+y1HxJEsXqKB7jCfxcnEmhsSI5tKuYXlmRx1L+Bx5vUi1+2MdRTUOayZvM3OF |
| qM3XkSNsbAwoWrdXddl4TjPmxarTy/B5XyDOTn9CyVjr0cAJ+gW8OwwJjTWzgxor33GqfYuVVis |
| QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHfe98htyl7vb+h6lKqmBfTBqE2Ki/DI/G8PxFVbE9WQ |
| MfuZ+vAwgbQzo/D7SYy7pGSFGoNIynipdCO3YNK0Z9sQ2xKi1RybF387ados34xOqqYZQbiPWK9 |
| Zf4SH0Qj7u0CI2+oG2pQiUWSnaQtLKlMshtdy5x8hc+a0LSVG8VXi |
| -----END OCSP RESPONSE----- |
| |
| $ openssl x509 -text < [CA CERTIFICATE] |
| Certificate: |
| Data: |
| Version: 3 (0x2) |
| Serial Number: 1 (0x1) |
| Signature Algorithm: sha1WithRSAEncryption |
| Issuer: CN = Test CA |
| Validity |
| Not Before: Jan 1 00:00:00 2017 GMT |
| Not After : Jan 1 00:00:00 2018 GMT |
| Subject: CN = Test Intermediate CA |
| Subject Public Key Info: |
| Public Key Algorithm: rsaEncryption |
| Public-Key: (1024 bit) |
| Modulus: |
| 00:b9:32:09:de:33:4a:4f:e2:04:73:49:d5:2e:2b: |
| 83:92:3a:94:e4:1b:0c:27:1b:f8:43:83:17:b8:75: |
| f5:a4:af:e3:4c:84:3e:6c:48:79:76:df:4d:f5:39: |
| af:92:4b:c5:a0:86:ab:35:cc:19:6b:93:82:c0:f8: |
| 44:4d:1a:14:5d:48:87:65:02:0e:b0:a8:96:d9:06: |
| 19:3f:aa:85:2d:84:c0:78:19:a6:96:ab:26:56:f7: |
| 6f:5a:1a:97:a2:01:88:00:99:10:8a:97:39:c8:22: |
| 6e:de:e5:56:f4:a6:23:cd:ea:48:0e:65:67:a4:73: |
| a0:50:91:de:ba:cf:54:08:8f |
| Exponent: 65537 (0x10001) |
| Signature Algorithm: sha1WithRSAEncryption |
| 48:d5:9f:8d:90:bc:4a:59:38:1d:2b:83:2d:71:1c:74:9d:01: |
| 73:a0:b6:98:e7:1c:c2:22:66:23:33:0a:8f:64:ff:9c:6b:37: |
| 09:12:1c:15:12:cb:c3:61:d9:ab:cd:96:dd:95:fa:a6:02:67: |
| 3c:4c:ec:98:38:5c:fc:48:cc:85:a9:5b:49:2c:2b:06:66:07: |
| 9e:31:0f:93:10:ab:3e:9f:97:60:64:01:61:7e:86:15:bb:5e: |
| f1:90:31:a3:54:d0:86:0e:80:05:87:09:2e:65:b6:95:89:5c: |
| c1:e5:80:d9:b8:81:b6:ed:1a:20:b8:9b:22:ce:ef:d0:26:47: |
| 9d:57 |
| -----BEGIN CA CERTIFICATE----- |
| MIIBqTCCARKgAwIBAgIBATANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDDAdUZXN0IENBMCIYDzI |
| wMTcwMTAxMDAwMDAwWhgPMjAxODAxMDEwMDAwMDBaMB8xHTAbBgNVBAMMFFRlc3QgSW50ZXJtZW |
| RpYXRlIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5MgneM0pP4gRzSdUuK4OSOpTkG |
| wwnG/hDgxe4dfWkr+NMhD5sSHl23031Oa+SS8Wghqs1zBlrk4LA+ERNGhRdSIdlAg6wqJbZBhk/ |
| qoUthMB4GaaWqyZW929aGpeiAYgAmRCKlznIIm7e5Vb0piPN6kgOZWekc6BQkd66z1QIjwIDAQA |
| BMA0GCSqGSIb3DQEBBQUAA4GBAEjVn42QvEpZOB0rgy1xHHSdAXOgtpjnHMIiZiMzCo9k/5xrNw |
| kSHBUSy8Nh2avNlt2V+qYCZzxM7Jg4XPxIzIWpW0ksKwZmB54xD5MQqz6fl2BkAWF+hhW7XvGQM |
| aNU0IYOgAWHCS5ltpWJXMHlgNm4gbbtGiC4myLO79AmR51X |
| -----END CA CERTIFICATE----- |
| |
| $ openssl x509 -text < [CERTIFICATE] |
| Certificate: |
| Data: |
| Version: 3 (0x2) |
| Serial Number: 4 (0x4) |
| Signature Algorithm: sha1WithRSAEncryption |
| Issuer: CN = Test Intermediate CA |
| Validity |
| Not Before: Jan 1 00:00:00 2017 GMT |
| Not After : Jan 1 00:00:00 2018 GMT |
| Subject: CN = Test Cert |
| Subject Public Key Info: |
| Public Key Algorithm: rsaEncryption |
| Public-Key: (1024 bit) |
| Modulus: |
| 00:bc:4c:d5:b3:8d:92:fa:66:ac:32:43:1a:9e:eb: |
| 17:e0:aa:76:35:1b:1d:10:48:4e:3e:22:8b:75:2e: |
| e8:6f:a4:55:1e:0a:5e:60:c0:61:f1:7d:29:58:7e: |
| 0b:ef:29:be:ad:f8:f7:43:c8:58:95:14:5b:1d:af: |
| 4a:b8:90:9e:4e:ec:4e:b3:86:7a:b9:96:c1:34:d3: |
| b9:a6:57:df:9b:bd:d9:dd:67:15:54:d4:9f:65:b8: |
| 33:29:59:ba:9a:c6:75:ea:a5:76:3d:a4:57:0f:e2: |
| e4:c3:91:35:1d:6e:ff:61:7d:c2:53:23:66:b2:a8: |
| 0b:e1:c7:55:48:c5:2b:4d:7d |
| Exponent: 65537 (0x10001) |
| Signature Algorithm: sha1WithRSAEncryption |
| 18:bb:93:d9:2a:e0:34:69:2f:96:57:ac:55:ac:a7:83:04:b4: |
| bc:22:7f:5f:f7:c0:dc:ac:af:13:9b:86:7e:ac:02:8c:44:83: |
| 2e:c0:fa:a1:77:1d:dd:86:31:7e:98:93:c0:4f:b2:3d:be:30: |
| 6f:a5:fc:c7:2e:b1:b8:08:d2:17:cb:60:55:bf:5a:e0:94:f3: |
| 1d:44:fa:b1:2f:1a:24:c5:33:e1:d4:f0:ac:d5:2c:67:da:a7: |
| 5d:ee:eb:d6:7a:a7:41:e8:94:7a:34:43:b2:1f:ab:e9:cf:5d: |
| 25:49:56:18:d2:a9:49:1a:37:34:43:c7:06:96:4a:29:38:cc: |
| f2:1c |
| -----BEGIN CERTIFICATE----- |
| MIIBqzCCARSgAwIBAgIBBDANBgkqhkiG9w0BAQUFADAfMR0wGwYDVQQDDBRUZXN0IEludGVybWV |
| kaWF0ZSBDQTAiGA8yMDE3MDEwMTAwMDAwMFoYDzIwMTgwMTAxMDAwMDAwWjAUMRIwEAYDVQQDDA |
| lUZXN0IENlcnQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALxM1bONkvpmrDJDGp7rF+Cqd |
| jUbHRBITj4ii3Uu6G+kVR4KXmDAYfF9KVh+C+8pvq3490PIWJUUWx2vSriQnk7sTrOGermWwTTT |
| uaZX35u92d1nFVTUn2W4MylZuprGdeqldj2kVw/i5MORNR1u/2F9wlMjZrKoC+HHVUjFK019AgM |
| BAAEwDQYJKoZIhvcNAQEFBQADgYEAGLuT2SrgNGkvllesVayngwS0vCJ/X/fA3KyvE5uGfqwCjE |
| SDLsD6oXcd3YYxfpiTwE+yPb4wb6X8xy6xuAjSF8tgVb9a4JTzHUT6sS8aJMUz4dTwrNUsZ9qnX |
| e7r1nqnQeiUejRDsh+r6c9dJUlWGNKpSRo3NEPHBpZKKTjM8hw= |
| -----END CERTIFICATE----- |
| |
| $ openssl asn1parse -i < [OCSP REQUEST] |
| 0:d=0 hl=2 l= 66 cons: SEQUENCE |
| 2:d=1 hl=2 l= 64 cons: SEQUENCE |
| 4:d=2 hl=2 l= 62 cons: SEQUENCE |
| 6:d=3 hl=2 l= 60 cons: SEQUENCE |
| 8:d=4 hl=2 l= 58 cons: SEQUENCE |
| 10:d=5 hl=2 l= 9 cons: SEQUENCE |
| 12:d=6 hl=2 l= 5 prim: OBJECT :sha1 |
| 19:d=6 hl=2 l= 0 prim: NULL |
| 21:d=5 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:449B1C5B31C6E9990966523E49C3F773C024190A |
| 43:d=5 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:FC6D3387CC3B39B049C755C46DF4395548930BCE |
| 65:d=5 hl=2 l= 1 prim: INTEGER :04 |
| -----BEGIN OCSP REQUEST----- |
| MEIwQDA+MDwwOjAJBgUrDgMCGgUABBREmxxbMcbpmQlmUj5Jw/dzwCQZCgQU/G0zh8w7ObBJx1X |
| EbfQ5VUiTC84CAQQ= |
| -----END OCSP REQUEST----- |
