mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-01-28 22:09:54 +01:00
0bf3a89992
Introduce support for OCSP stapling in TLS 1.3. Note: OCSP Stapling v2 is not used in TLS 1.3. Added tests. Allow extensions to be sent with first certificate. Fix writing out of certificate chains in TLS 1.3. Tidy up the OCSP stapling code to remove duplication as much as possible.
70 lines
2.3 KiB
Bash
Executable File
70 lines
2.3 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# ocsp-stapling.test
|
|
|
|
trap 'for i in `jobs -p`; do pkill -TERM -P $i; done' EXIT
|
|
|
|
server=login.live.com
|
|
ca=certs/external/baltimore-cybertrust-root.pem
|
|
|
|
[ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
|
|
./examples/client/client -? 2>&1 | grep -- 'Client not compiled in!'
|
|
if [ $? -eq 0 ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# is our desired server there? - login.live.com doesn't answers PING
|
|
#./scripts/ping.test $server 2
|
|
|
|
# client test against the server
|
|
./examples/client/client -X -C -h $server -p 443 -A $ca -g -W 1
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
|
|
|
|
|
|
# Test with example server
|
|
|
|
./examples/server/server -? 2>&1 | grep -- 'Server not compiled in!'
|
|
if [ $? -eq 0 ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# setup ocsp responder
|
|
./certs/ocsp/ocspd-intermediate1-ca-issued-certs.sh &
|
|
sleep 1
|
|
[ $(jobs -r | wc -l) -ne 1 ] && echo -e "\n\nSetup ocsp responder failed, skipping" && exit 0
|
|
|
|
# client test against our own server - GOOD CERT
|
|
./examples/server/server -c certs/ocsp/server1-cert.pem -k certs/ocsp/server1-key.pem &
|
|
sleep 1
|
|
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
|
|
|
|
# client test against our own server - REVOKED CERT
|
|
./examples/server/server -c certs/ocsp/server2-cert.pem -k certs/ocsp/server2-key.pem &
|
|
sleep 1
|
|
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1
|
|
RESULT=$?
|
|
[ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1
|
|
|
|
|
|
./examples/client/client -v 4 2>&1 | grep -- 'Bad SSL version'
|
|
if [ $? -ne 0 ]; then
|
|
# client test against our own server - GOOD CERT
|
|
./examples/server/server -c certs/ocsp/server1-cert.pem -k certs/ocsp/server1-key.pem -v 4 &
|
|
sleep 1
|
|
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1
|
|
RESULT=$?
|
|
[ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
|
|
|
|
# client test against our own server - REVOKED CERT
|
|
./examples/server/server -c certs/ocsp/server2-cert.pem -k certs/ocsp/server2-key.pem -v 4 &
|
|
sleep 1
|
|
./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1
|
|
RESULT=$?
|
|
[ $RESULT -ne 1 ] && echo -e "\n\nClient connection suceeded $RESULT" && exit 1
|
|
fi
|
|
|
|
exit 0
|