Function validateOCSPResponder

ocsp.go:265–282

validateOCSPResponder enforces RFC 6960 §4.2.2.2: "Systems or applications that rely on OCSP responses MUST be capable of detecting and enforcing the use of the id-kp-OCSPSigning value." An issuer-signed response (where the embedded Certificate field is nil, meaning the issuer signed directly) is al

(ocspResp *ocsp.Response, issuerCert *x509.Certificate)

// id-kp-OCSPSigning value." An issuer-signed response (where the embedded Certificate
// field is nil, meaning the issuer signed directly) is always acceptable.
func validateOCSPResponder(ocspResp *ocsp.Response, issuerCert *x509.Certificate) error {
	respCert := ocspResp.Certificate

	// if response was signed directly by the issuer, or embedded responder cert IS the issuer, accept
	if respCert == nil || respCert.Equal(issuerCert) {
		// Response was signed directly by the issuer — always valid.
		return nil
	}

	// RFC 6960 §4.2.2.2 requires id-kp-OCSPSigning for delegated responders
	for _, eku := range respCert.ExtKeyUsage {
		if eku == x509.ExtKeyUsageOCSPSigning {
			return nil
		}
	}

	return fmt.Errorf("OCSP responder certificate (subject: %s) is not the issuer and does not carry id-kp-OCSPSigning", respCert.Subject)
}