[TS-3384] Add stats for OCSP Stapling errors

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 6.0.0
• Component/s: SSL
• Labels: review
• Assignee: Bryan Call
• Reporter: Feifei Cai
• Created: 10/Feb/15 12:50
• Updated: 04/Feb/16 18:55
• Resolved: 19/Jun/15 03:38

Description

1. Add stats for bad OCSP response status: revoked or unknown.

   $ traffic_line -m proxy.process.ssl.ssl_ocsp
   proxy.process.ssl.ssl_ocsp_revoked_cert_stat 0
   proxy.process.ssl.ssl_ocsp_unknown_cert_stat 0
   

     OCSP_resp_find_status(bs, cinf->cid, &status, &reason, &rev, &thisupd, &nextupd);
   
     switch (status) {
       case V_OCSP_CERTSTATUS_GOOD:
         break;
       case V_OCSP_CERTSTATUS_REVOKED:
         SSL_INCREMENT_DYN_STAT(ssl_ocsp_revoked_cert_stat);
         break;
       case V_OCSP_CERTSTATUS_UNKNOWN:
         SSL_INCREMENT_DYN_STAT(ssl_ocsp_unknown_cert_stat);
         break;
       default:
         break;
     }
   

2. change debug tag in OCSP Stapling to ssl_ocsp.

Issue Links

• blocks: TS-3669 ☂ Critical issues for v6.0.0 release
• relates to: TS-2367 Add OCSP (Online Certificate Status Protocol) Stapling Support