Fix certcache to allow self-signed certs.

[twifkak]

If the cert doesn't have an AIA extension with an OCSP responder URL,
then the cache will just include a fake (invalid) OCSP response in its
cert-chain+cbor. This is sufficient for displaying the SXG in Chrome
with --ignore-certificate-errors-spki-list.

Fixes #352.

[twifkak]

Note to reviewer: Marking this as "draft" because I'd rather not add another merge conflict for you to deal with in #349, plus maybe you have a better suggestion than my sentinel value hack.

[banaag]

I think you need to modify the certcache instantiation in gateway_server as well.

[twifkak]

Done.

[shigeki]

It is possible to create a valid OCSP response by using the private key of a self-signed cert such as gateway.go does. But it needs two certs to have the same private key.

amppackager/cmd/gateway_server/server.go

Lines 148 to 161 in c9993b8

	var ocspDer []byte
	if len(certs) > 1 {
	// Attach an OCSP response, signed with the second cert in the
	// chain (assumed to be the issuer and using the same private
	// key as the leaf cert).
	var err error
	ocspDer, err = createOCSPResponse(certs[1], privateKey.(*ecdsa.PrivateKey))
	if err != nil {
	return errorToSXGResponse(err), nil
	}
	} else {
	// Make up an invalid OCSP response.
	ocspDer = []byte("ocsp")
	}

Or we can add an additional config to specify the issuer private key file to create a valid OCSP response.

[twifkak]

Thanks for the pointer; I didn't remember that gateway server did that. However, it seems that the gateway server doesn't fully exercise the certcache code, so it succeeds, whereas my attempt to adopt this fails, with "error validating fake response: bad OCSP signature: x509: ECDSA verification failure". Can you take a look at https://play.golang.org/p/8owXw00LsRx and see if you can find the error in my code?

[shigeki]

The error can be resolved with the fix of https://play.golang.org/p/CvVyUD-_tji . The private key needs to be the issuer key which corresponds to the self-signed cert key in this case.

[twifkak]

Ah, yes, that makes perfect sense. Thanks for the bug fix; I've updated this to generate a GOOD OCSP response as suggested.