4

I have deployed basic ocsp server from OpenSSl Cookbook by Ivan Ristic page 44 with following command:

openssl ocsp -port 9080 -index db/index -rsigner root-ocsp.crt -rkey private/root-ocsp.key -CA root-ca.crt -text

And I want to investigate ocsp request content to my server in Wireshark:

 openssl ocsp -issuer root-ca.crt -CAfile root-ca.crt -cert root-ocsp.crt -url http://127.0.0.1:9080

with filter port 9080 applied to loopback (device?) I get necessary tcp packages:

image

How to show their content in oscp format?

P.S. I cannot apply oscp filter, wireshark mark it with red.

4
  • 1
    Since this is a HTTP request which includes the OCSP request you have to use HTTP as the protocol to show the details. IMHO Wireshark then displays the OCSP request and response in the body of the request/response as long as they have the correct Content-Type set. Mar 19 '17 at 11:22
  • I have recorded transaction on image, when I write http to Apply a display filter... no packages is displayed, how I must set HTTP as the protocol to show the details? As you can see, content-type is present
    – srghma
    Mar 19 '17 at 11:49
  • 1
    A display filter filters only, i.e. does not change how data are displayed but only which data are displayed. You have to change how the data are decoded instead. How this is done depends on the version of Wireshark. But for example Analyze | Decode As in current version. Mar 19 '17 at 12:29
  • Thanks, your answers had pushed me on right solution. It was very important for me
    – srghma
    Mar 19 '17 at 12:48
2

In order to activate OCSP decoding, I had to activate HTTP decoding

Edit -> Preferences -> Protocols -> HTTP -> TCP Ports: add 9080

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.