title: root ca not trusted - OCSP responder with nginx https server
body: <p>For testing purposes I am trying to setup an https server, only for communication within a local network. TLS two way authentication and also OCSP stapling has to be used (due to the requirements of the client). </p>
  
  <p>For nginx I have a basic setup:</p>
  
  <pre><code>listen 44300 ssl default_server;
      listen [::]:44300 ssl default_server;
      ssl on;
      ssl_certificate /home/user/work/Telematics2/server/certificate.crt;
      ssl_certificate_key /home/user/work/Telematics2/server/certKey.key;
      ssl_protocols TLSv1.2 TLSv1.3;
  
      ssl_verify_client optional_no_ca;
      ssl_client_certificate /home/user/work/Telematics2/client/certificate.crt;
  
      ssl_stapling on;
      ssl_stapling_verify on;
      ssl_trusted_certificate /home/user/work/Telematics2/server/concat.crt;
  </code></pre>
  
  <p>For testing I created server and client keys on my local machine with following commands: </p>
  
  <pre><code>openssl genrsa -out rootCA.key 1024
  
  openssl req -new -x509 -days 3650 -key rootCA.key -out rootCA.crt -config validation.cnf -subj /C=DE/ST=BW/L=Earth/O=CompanyName/OU=IT/CN=X.X.X.X/emailAddress=email@example.com
  
  openssl genrsa -out certKey.key 1024
  
  openssl req -new -x509 -days 3650 -key certKey.key -out certificate.crt -config validation.cnf -subj /C=DE/ST=BW/L=Earth/O=CompanyName/OU=IT/CN=X.X.X.X/emailAddress=email@example.com
  
  openssl x509 -x509toreq -in certificate.crt -out CSR.csr -signkey certKey.key
  
  openssl ca -batch -startdate 150813080000Z -enddate 250813090000Z -keyfile rootCA.key -cert rootCA.crt -policy policy_anything -config validation.cnf -notext -out certificate.crt -infiles CSR.csr
  
  openssl req -new -nodes -out ocspSigning.csr -keyout ocspSigning.key -subj /C=DE/ST=BW/L=Earth/O=CompanyName/OU=IT/CN=X.X.X.X/emailAddress=email@example.com
  
  yes | openssl ca -keyfile rootCA.key -cert rootCA.crt -in ocspSigning.csr -out ocspSigning.crt -config validation.cnf
  </code></pre>
  
  <p>The config contains following extra lines:</p>
  
  <pre><code>[ usr_cert ]
  authorityInfoAccess = OCSP;URI:http://X.X.X.X:8080
  [ v3_OCSP ]
  basicConstraints = CA:FALSE
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  extendedKeyUsage = OCSPSigning
  </code></pre>
  
  <p>I then started an OCSP server with openssl:</p>
  
  <pre><code>openssl ocsp -index demoCA/index.txt -port 8080 -rsigner ocspSigning.crt -rkey ocspSigning.key -CA rootCA.crt -text
  </code></pre>
  
  <p>and tried to access a simple html file on the server:</p>
  
  <pre><code>curl -v -L -k --cert /home/user/work/Telematics2/client/certificate.crt --key /home/user/work/Telematics2/client/certKey.key https://X.X.X.X:44300/index.html --cert-status --cacert /home/user/work/Telematics2/server/rootCA.crt
  </code></pre>
  
  <p>This gives me the following output:</p>
  
  <pre><code>*   Trying X.X.X.X...
  * TCP_NODELAY set
  * Connected to X.X.X.X (X.X.X.X) port 44300 (#0)
  * ALPN, offering h2
  * ALPN, offering http/1.1
  * successfully set certificate verify locations:
  *   CAfile: /home/user/work/Telematics2/server/rootCA.crt
    CApath: /etc/ssl/certs
  * TLSv1.3 (OUT), TLS handshake, Client hello (1):
  * TLSv1.3 (IN), TLS handshake, Server hello (2):
  * TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (IN), TLS handshake, Unknown (8):
  * TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (IN), TLS handshake, Request CERT (13):
  * TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (IN), TLS handshake, Certificate (11):
  * TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (IN), TLS handshake, CERT verify (15):
  * TLSv1.3 (IN), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (IN), TLS handshake, Finished (20):
  * TLSv1.3 (OUT), TLS change cipher, Client hello (1):
  * TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (OUT), TLS handshake, Certificate (11):
  * TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (OUT), TLS handshake, CERT verify (15):
  * TLSv1.3 (OUT), TLS Unknown, Certificate Status (22):
  * TLSv1.3 (OUT), TLS handshake, Finished (20):
  * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
  * ALPN, server accepted to use http/1.1
  * Server certificate:
  *  subject: C=DE; ST=BW; L=Earth; O=CompanyName; OU=IT; CN=X.X.X.X; emailAddress=email@example.com
  *  start date: Aug 13 08:00:00 2015 GMT
  *  expire date: Aug 13 09:00:00 2025 GMT
  *  issuer: C=DE; ST=BW; L=Earth; O=CompanyName; OU=IT; CN=X.X.X.X; emailAddress=email@example.com
  *  SSL certificate verify ok.
  * No OCSP response received
  * stopped the pause stream!
  * Closing connection 0
  * TLSv1.3 (OUT), TLS Unknown, Unknown (21):
  * TLSv1.3 (OUT), TLS alert, Client hello (1):
  curl: (91) No OCSP response received
  </code></pre>
  
  <p>and the nginx error.log says:</p>
  
  <pre><code>2020/02/19 14:53:04 [error] 29340#29340: OCSP_basic_verify() failed (SSL: error:2706A067:OCSP routines:ocsp_check_delegated:missing ocspsigning usage error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted) while requesting certificate status, responder: X.X.X.X, peer: X.X.X.X:8080, certificate: "/home/user/work/Telematics2/server/certificate.crt"
  </code></pre>
  
  <p>But the above started ocsp server actually prints:</p>
  
  <pre><code>OCSP Response Data:
      OCSP Response Status: successful (0x0)
      Response Type: Basic OCSP Response
      Version: 1 (0x0)
      Responder Id: C = DE, ST = BW, O = CompanyName, OU = IT, CN = X.X.X.X, emailAddress = email@example.com
      Produced At: Feb 19 14:17:18 2020 GMT
      Responses:
      Certificate ID:
        Hash Algorithm: sha1
        Issuer Name Hash: 3CFD1A620E876EB93992CA04B1903C354AC6C614
        Issuer Key Hash: 1E01DD83D567E3E111FD89E26B2636964C26AFDC
        Serial Number: 01
      Cert Status: good
      This Update: Feb 19 14:17:18 2020 GMT
  </code></pre>
  
  <p>I am not really an expert on this topic so I don't really know what to do next. I feel like the issue might be with the certificates, because it is the part I am most unsure about. I don't really need the security provided by OCSP but the client requires this step for a successful authentication, but it would be fine if I can just trust any CA if this is somehow possible.</p>