OCSP query for intermediate certificate without issuer certificate - ssl

Question

I have written a TLS code which is doing mutual authentication at Java, so client is sending its certificate after server sends its certificate. I would like to validate all the certificates in certificate chain by OCSP which is coming from client side to server side.
I have written my loop logic as assuming that last certificate is root(CA) certificate in the chain and not to send any OCSP query for it;
int certificateChainSize= x509Certificates.length;
// Verifies certificate chain respectively (issuer certificate required).
CertificateResult response = null;
try {
for (int i = 0; i < certificateChainSize-1 ; i++) {
response = client.verify(x509Certificates[i], x509Certificates[i+1]);
}
} catch (OcspException e) {
e.printStackTrace();
}
When I test TLS and get Wireshark capture, I realized that Google Chrome as client has been sending certificate chain without root. As a result; intermediate certificate is not queried because of loop logic, because my code assumed the intermedite certificate is root. I need issuer certificate for validation to any certificate in chain. Is there any mechanism validation without issuer certificate(in case: root certificate).

Answer 1

I think, your design is flawed.
There is no need to validate certificate against OCSP server when you don't have root certificate, because the chain is untrusted and OCSP validation makes zero sense.
In major cryptographic libraries, revocation checking occurs as a last step when all possible certificate chains are constructed, best chain is selected and it is successfully validated against various validation rules (most of them are described in §6 of RFC 5280 ). Only when all checks are successful, client attempts revocation checking for each certificate in the chain. And successful chain building and validation will imply that you already have trusted root certificate, because valid chains are built up to root certificate.
In addition, as it was said in your previous thread Force Chrome to send all certificates in chain during TLS :
For maximum compatibility, all implementations SHOULD be prepared to handle potentially extraneous certificates and arbitrary orderings from any TLS version, with the exception of the end-entity certificate which MUST be first.
This statement implies that subsequent i+1 certificate may not be necessary an issuer of the current i certificate. As the result, this line:
response = client.verify(x509Certificates[i], x509Certificates[i+1]);
will return unexpected results, because its input is wrong.
what you really should do: let the OS cryptographic library (which is shipped as a part of operating system) to do the hardest work. I strongly encourage to not invent your own crypto and use proven tools. Every OS has APIs that will build, arrange and validate certificate chains and return you best one. You should use this chain as an input of your OCSP validation code and your for loop will be considered reliable (depening on internal logic of verify method).
Like I said, if chain building process fails, there is no much reason to perform OCSP validation.