Fix OCSP.verify_response() to check cert_status#14
Fix OCSP.verify_response() to check cert_status#14lnagel wants to merge 1 commit intothorgate:mainfrom
Conversation
Previously, verify_response() only checked response_status (whether the OCSP server processed the request) but not cert_status (whether the certificate is actually valid). This meant revoked and unknown certificates silently passed validation. Now raises OCSPCertificateRevokedError for revoked certificates and OCSPCertificateUnknownError for unknown status. Fixes thorgate#13 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
Hi @lnagel, thanks for opening this PR and for the detailed issue writeup in #13! This looks like a legitimate gap in the validation logic, we'll take a closer look at the changes and the test coverage. We'll get back to you with a proper review soon. Thanks again for the contribution! |
Our customers have been sporadically experiencing situations where the signing process succeeds normally, but later when opening the .asice containers, the signatures render as "invalid" -- legally not binding. We have been tracing this for a while now and performed a security and compliance audit to pyasice. We covered several gaps in the implementation vs. required standards. This bugfix here is for the case where an incorrect OCSP server was consulted and pyasice considered its response a success, when in reality, that server replied with "certificate status unknown". In reality, for newer Smart ID certificates, a different server must be consulted. I filed the results of that audit into GitHub issue tickets in case they might be of use. |
We currently have a digital signing service in production with pyasice deployed on a public cloud. Basically this uses all the big three signing methods: smart-id, mobile-id and smartcards. This was built around pyasice as it was very convenient for handling the container files directly from an async Python context. After review of the compliance audit results, consulting with the customer and within the team, we decided ultimately to switch to using libdigidocpp and libcdoc directly from python. For this purpose we are publishing and maintaining now the Python bindings for both libraries: Sources for the bindings are available in GitHub at: |
2 participants
Summary
cert_statuscheck toverify_response()method to properly validate certificate validityOCSPCertificateRevokedErrorexception for revoked certificatesOCSPCertificateUnknownErrorexception for unknown certificate statusPreviously,
verify_response()only checkedresponse_status(whether the OCSP server processed the request) but notcert_status(whether the certificate is actually valid). This meant revoked and unknown certificates silently passed validation.Fixes #13
Test plan
pytest pyasice/tests/test_ocsp.py -v- all 7 tests passpytest -v- all 45 tests pass🤖 Generated with Claude Code