OpenVPN: Allow Nonce Validation to be disabled when using OCSP

[ybayart]

Hi,

Here is an implementation of Nonce validation disabling, initially proposed by the author of OCSP validation: #7082 (comment)

Additionally there might be some more settings that should be at least considered if they should be configurable:
nonce usage (https://www.openssl.org/docs/man3.0/man3/OCSP_check_nonce.html)

Validation is done this way, by checking if the first line is an OK response ($output corresponds to the lines)

core/src/opnsense/mvc/app/library/OPNsense/Trust/Store.php

Line 646 in 5eddbce

'pass' => $status == 'good' && trim($output[0]) == 'Response verify OK',

In cases where the OCSP Responder does not support Nonce, a response of this type is returned

# openssl ocsp -resp_no_certs -timeout 10 -nonce -CAfile $OCSP_CA -issuer $OCSP_CA -url $OCSP_URL -serial 463050772713033790379517141507295683732909432205
WARNING: no nonce in response
Response verify OK
463050772713033790379517141507295683732909432205: good
	This Update: Sep 25 14:33:37 2025 GMT
	Next Update: Sep 26 02:33:37 2025 GMT

By changing the -nonce parameter to -no_nonce, we get a request that can be parsed correctly

# openssl ocsp -resp_no_certs -timeout 10 -no_nonce -CAfile $OCSP_CA -issuer $OCSP_CA -url $OCSP_URL -serial 463050772713033790379517141507295683732909432205
Response verify OK
463050772713033790379517141507295683732909432205: good
	This Update: Sep 25 14:33:42 2025 GMT
	Next Update: Sep 26 02:33:42 2025 GMT

I use the OCSP Responder integrated into Vault community (Hashicorp).

[AdSchellevis]

... initially proposed by the author of OCSP validation

well, technically, that's not completely true, the code originates from 318a1ae ;)

I don't mind that much adding an advanced option, although I do find it a bit odd they don't implement nonce on their end as apparently it's quite common to require them (hashicorp/vault#29364)

[AdSchellevis]

I think ocsp_no_nonce is indeed the better name in this case, disabled by default, the rest of the code just doesn't seem to reflect that (e.g. ocsp_nonce).

[ybayart]

Well, that's the logic I used initially (and an artifact I forgot to change before commit), but I found it a little confusing to have a negation.
anyway, now it's ocsp_no_nonce :)

[AdSchellevis]

@ybayart I've added a couple of suggestions for the labels and help texts, the code itself looks ok.

[AdSchellevis]

Suggested change

	<help>When your OCSP Responder does not support Nonce Validation, a warning is returned and validation fails.</help>
	<help>When your OCSP Responder does not support the Nonce Extension, validation will fail. This option disables Nonces at the cost of loosing protection against replay attacks</help>

[AdSchellevis]

Suggested change

	<label>Disable OCSP Nonce validation</label>
	<label>Disable OCSP Nonce extension</label>