OCSP Support

[reaperhulk]

This is a meta-issue to track the various PRs and the overall state of OCSP support in cryptography.

Current state: nothing done!

[reaperhulk]

Some discussion here: #4261 (comment)

[reaperhulk]

We can now both parse and generate OCSP requests and responses in master. Closing as fixed for 2.4.

[FranklinYu]

Is there any example how do we send out OCSP requests with this module? I would like to send OCSP request and save the response in a file.

[reaperhulk]

https://cryptography.io/en/latest/x509/ocsp/#creating-requests documents how to create requests. You must send encoded requests via POST (DER encoded) or GET (base64 encoded) to the OCSP server yourself.

[FranklinYu]

@reaperhulk Thanks. I read the details in RFC 6960; shall we link to that RFC in the OCSP page of our documentation? Or even better, also provides an example using requests library? I think others may also benefit from that.

[reaperhulk]

We'd be happy to take a docs PR for this!

[FranklinYu]

Would the OCSP Request Builder also tell me the endpoint URL?

[reaperhulk]

No, you'll need to parse that out of the certificate. It will be in the AuthorityInformationAccess extension.

[FranklinYu]

Does it make sense to include this in the OCSP Request Builder? I can PR if you like

[reaperhulk]

Destination of request is separate from building it. An example showing this complete flow is very welcome but I don’t think it makes sense to add anything to the builder.