upstream/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-06-07 15:52:08 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Start handling some weirder OCSP states

Browse source
This commit is contained in:
Peter Eckersley 2016-12-22 18:51:17 -08:00
parent aaffe2f9ca
commit 0011a3b7d8
2 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
certbot/ocsp.py
View file

@ -1,5 +1,6 @@
"""Tools for checking certificate revocation."""
import logging
import re
from subprocess import Popen, PIPE
@ -95,15 +96,21 @@ class RevocationChecker(object):
def _translate_ocsp_query(cert_path, ocsp_output, ocsp_errors):
"""Parse openssl's weird output to work out what it means."""
if not "Response verify OK" in ocsp_errors:
pattern = r"{0}: (WARNING.*)good".format(cert_path)
good = re.search(pattern, ocsp_output, flags=re.DOTALL)
warning = good.group(1) if good else None
if (not "Response verify OK" in ocsp_errors) or (good and warning):
logger.info("Revocation status for %s is unknown", cert_path)
logger.debug("Uncertain ouput:\n%s\nstderr:\n%s", ocsp_output, ocsp_errors)
return False
if cert_path + ": good" in ocsp_output:
if good and not warning:
return False
elif cert_path + ": revoked" in ocsp_output:
return True
else:
logger.warn("Unable to properly parse OCSP output: %s", ocsp_output)
logger.warn("Unable to properly parse OCSP output: %s\nstderr:%s",
ocsp_output, ocsp_errors)
return False

10
certbot/tests/ocsp_test.py
View file

@ -133,5 +133,15 @@ blah.pem: revoked
openssl_broken = ("", "tentacles", "Response verify OK")
openssl_expired_ocsp = ("blah.pem", """
blah.pem: WARNING: Status times invalid.
140659132298912:error:2707307D:OCSP routines:OCSP_check_validity:status expired:ocsp_cl.c:372:
good
This Update: Apr 6 00:00:00 2016 GMT
Next Update: Apr 13 00:00:00 2016 GMT
""",
"""Response verify OK""")
if __name__ == '__main__':
unittest.main() # pragma: no cover