Add OCSP stapling for both client and server

[theo546]

Use case

Introduce an OCSP stapling system so that Maddy can check the certificates of servers it's connecting to, but also send an OCSP reponse of the certificate the mail server is currently using when an e-mail is being received.

That would be a killer feature and Maddy would be the "second" known mail server to have such a feature!

Your idea for a solution

I have no idea for a solution as I am not good enough with the Go language to provide anything worthful.

• I'm willing to help with the implementation

[foxcpp]

For client, we would need to have an OCSP verifier which does not seem to be available in the standard library or x/crypto:
golang/go#40017
And there does not seem to be a reasonably complete verification implementation on GitHub.

Once one is available - it should be trivial to plug it into maddy and have OCSP verification working.

[foxcpp]

As for stapling OCSP responses on server side, this is something we could probably work on. Need to study how caddy does it and see if we can share any code.

[foxcpp]

I wonder if we can tear out our TLS management code and replace it with certmagic (https://github.com/caddyserver/certmagic) that also seems to implement OCSP stapling in addition to ACME (thus we will also solve #3).

[foxcpp]

Otherwise the code to steal is https://github.com/caddyserver/certmagic/blob/eba05a818ed35af0d015b6799486afff704ffa28/ocsp.go#L31

[foxcpp]

While I believe it is unfeasible for us to fully replace our TLS management code with Certmagic, I believe we can integrate it into tls.loader.file good enough so it could handle OCSP stapling for us. I will experiment with it while implementing #3.

[foxcpp]

tls.loader.acme introduced by 93cf4f2 supports OCSP stapling.

[theo546]

That's amazing! You managed to implement a feature like that in no time, that's amazing!

I got a question though, does OCSP stapling works when using certificates generated by an external software (eg: acme.sh)?

[foxcpp]

Yeah. That's the problem. It works only for certificates automatically obtained using built-in ACME client now.

[mo-rijndael]

Today I tried switching maddy to ACME TLS, and it stopped working completely (read timeouts on SMTP clients, connection reset by peer on maddy side)
The only error shown in logs (even with debug mode) is OCSP stapling error[1] (because LE don't provide it anymore)
Do maddy consider OCSP stapling required?

[1] tls.loader.acme: stapling OCSP {"error":"no OCSP stapling for [$MADDY_HOSTNAME]: no OCSP server specified in certificate","identifiers":["$MADDY_HOSTNAME"]}