New x509-types signing type OCSP

[Slamoth]

ns_cert_type needs to be empty for OSCP responder certificates.
Current executable only outputs TLS Web Server Authentication as X509v3 Extended Key Usage.
Check below.

X509v3 Extended Key Usage:
                TLS Web Server Authentication

needs to be

X509v3 Extended Key Usage: critical
                OCSP Signing

OCSP responder certificate signing can be added to the easyrsa executable by modifying after line 2247 and putting a file under x509-types directory as ocsp file.
The change below in easyrsa executable allows X509v3 Extended Key Usage: critical OCSP Signing.

		# Netscape extension
		case "$crt_type" in
			serverClient)
				ns_cert_type="nsCertType = serverClient" ;;
			server)
				ns_cert_type="nsCertType = server" ;;
			client)
				ns_cert_type="nsCertType = client" ;;
			ca)
				ns_cert_type="nsCertType = sslCA" ;;
			ocsp)
				ns_cert_type="" ;;
			*)
				ns_cert_type="nsCertType = $crt_type"
		esac

And ocsp file in x509-type directory includes the following content.

# OCSP Responder Certificate

basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning
authorityKeyIdentifier = keyid,issuer
subjectKeyIdentifier = hash

and after that you can generate an ocsp req and sign it with the below commands.

./easyrsa gen-req ocsp_responder nopass
./easyrsa sign-req ocsp ocsp_responder

For testing purposes:

OCSP Server Command

# OCSP Server
openssl ocsp -index /easyrsa/pki/index.txt \
    -port 2560  -rsigner /easyrsa/pki/issued/ocsp_responder.crt \
    -rkey /easyrsa/pki/private/ocsp_responder.key \
    -CA /easyrsa/pki/ca.crt \
    -text -out /easyrsa/ocsp.log

OCSP Request Command

# OCSP Request
openssl ocsp -CAfile /easyrsa/pki/ca.crt \
    -issuer /easyrsa/pki/ca.crt \
    -cert /easyrsa/pki/issued/myserver.testdomain.com.crt \
    -url http://localhost:2560 -resp_text

[Slamoth]

Does exporting EASYRSA_NS_COMMENT parameter as empty causes the same behaviour ?

[TinCanTech]

@Slamoth If EASYRSA_NS_SUPPORT is not set to YES then no Netscape extensions are included in the signed certificate.

I can see what you are trying to achieve and I will take a closer look.

Side note: I realise that sign-req is a little strict on unknown X509 types, eg. OSCP. I want to make this more extensible anyway, so let me do that first and I'll use OSCP as a test type.