OCSP stapling validation inconsistencies across Qt 6 network backends
19.5K reputation · 24 Feb 2020, 12:37 UTC
In Qt 6.x, the Qt Network module utilizes platform-specific backends such as OpenSSL on Linux and Schannel on Windows to handle TLS handshakes. While core certificate validation is generally managed through the QSslError signal, the behavior regarding OCSP stapling remains inconsistent across these environments.
When a server provides an OCSP staple response during the handshake, some backends fail to properly validate the status response, while others may ignore the stapled data entirely. This discrepancy is particularly problematic when applications require strict revocation checks to ensure security without relying on external DNS-based responder lookups.
How does Qt handle a missing or malformed OCSP staple when the underlying backend does not natively support status validation? Is there a unified way to enforce OCSP stapling requirements regardless of the platform-specific SSL implementation being used?