stapled | OCSP stapling daemon | TLS library

For anyone who needs help with this problem, my above echo reconnection code seems to be pretty stable, along with a keepAlive function to determine the state of the HTTP connection. I am still a bit uncertain of the origin of the console errors I am seeing, but I suspect they have to do with connection loss during a sleep cycle, which is not something I am particularly worried about.

I'd still be interested in hearing other thoughts if anyone has any. I am somewhat inclined to believe long-term stability of an echo connection is possible, though it does appear you have to proactively monitor it with what tools you have available.

IO::Socket::SSL can verify self signed certificate only if it trusts the certificate authority file that you use to self sign the certificate.

I think you need to pass proper SSL_ca_file or SSL_ca_path to IO::Socket::SSL so that certificate authority file is accessible to it. This is the first thing mentioned in common usage errors section of IO::Socket::SSL docs.

As you already mentioned correctly, stapling is done during the handshake. I only know how to do this in the C# port of Bouncy Castle, since I'm implementing a PKIX crypto component based on BC, which also considers OCSP and which simplifies the BC calls dramatically (I will report it here when I'm ready to publish an alpha version, will most likely be open source).

First of all, according to RFC6066, stapling responses are only sent if you ask for them in the Client-Hello. To enable this, you have to override GetClientExtensions of your TlsClient (e.g. when you inherit from DefaultTlsClient):

Device-dependent actions (like Staple, and also Duplex, Tumble, Collate etc) are expected to be controlled, in language level 2 or 3, by calling setpagedevice.

Some device-dependent features (eg Duplex) are well defined in the specification, others are less well defined and manufacturers can create key/value pairs of their own, which are totally undefined. The way the setpagedevice operator works it will ignore anything which it doesn't understand.

So I would expect:

Eventually, I solved this by patching IO::Socket::SSL, to support a new SSL_ocsp_check_callback argument.

I evaluate it in connect_SSL(), right after all of the other OCSP attempts. Here's the patch I used (over perl-IO-Socket-SSL-2.025-1.noarch)

Works For Me™ with IO::Socket::SSL 2.052, WWW::Mechanize 1.86, and Net::SSLeay 1.80. I suspect you need to upgrade Net::SSLeay. I'd suggest upgrading all of them.

The differences start here. Yours considers the cert to not be ok.

SSL server (if configured correctly) will send certificate chain (except root CA certificate). You can verify it here.

Openssl did not fetch these certificate but it got them served when initiating ssl connection. You can read more about s_client behavior in openssl documentation

I don't know if it performs OCSP verification but I doubt it. IMHO (based on The s_client utility is a test tool and is designed to continue the handshake after any certificate verification errors.) it does not perform any validation by default at all but you can at least enable CRL checking by specifying argument -crl_check_all

As @Dunno mentioned in a comment, it does not give much meaning to compare a NaN with a number, so this behaviour is probably ok. The IEEE 754 standard says this about comparing NaNs with numbers:

Four mutually exclusive relations are possible: less than, equal, greater than, and unordered. The last case arises when at least one operand is NaN. Every NaN shall compare unordered with everything, including itself

According to the standard this: