From 496652a847a6dc19b125dff13f3f5a840e140ceb Mon Sep 17 00:00:00 2001 From: Cory Benfield Date: Tue, 24 Jan 2017 11:42:56 +0000 Subject: Add support for OCSP stapling. (#580) * Define the OCSPCallbackHelper. * Define set_ocsp_status_callback function. * Reframe this as the "server" helper. * Add OCSP helper. * Allow clients to request OCSP * Some tests for OCSP. * Don't forget to throw callback errors. * Add changelog entry for OCSP stapling. * Require at least cryptography 1.7 * Sorry Flake8, won't happen again. * How does spelling work? --- CHANGELOG.rst | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'CHANGELOG.rst') diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 7085711..5df500c 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -25,6 +25,10 @@ Changes: - Added ``OpenSSL.X509Store.set_time()`` to set a custom verification time when verifying certificate chains. `#567 `_ +- Added a collection of functions for working with OCSP stapling. + None of these functions make it possible to validate OCSP assertions, only to staple them into the handshake and to retrieve the stapled assertion if provided. + Users will need to write their own code to handle OCSP assertions. + We specifically added: ``Context.set_ocsp_server_callback``, ``Context.set_ocsp_client_callback``, and ``Connection.request_ocsp``. - Changed the ``SSL`` module's memory allocation policy to avoid zeroing memory it allocates when unnecessary. This reduces CPU usage and memory allocation time by an amount proportional to the size of the allocation. For applications that process a lot of TLS data or that use very lage allocations this can provide considerable performance improvements. -- cgit v1.2.1