denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Use pki --ocsp as OCSP responder

Browse Source 
The only exception is the ikev2/ocsp-no-signer-cert scenario as the
pki command won't sign an OCSP response with a certificate that isn't
the CA certificate or marked as an OCSP signer.
This commit is contained in:
Tobias Brunner
2023-11-13 12:50:47 +01:00
parent 5764e1e506
commit c10a13589e
9 changed files with 19 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0
testing/hosts/winnetou/etc/ca/research/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca/research
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert researchCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0
testing/hosts/winnetou/etc/ca/sales/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca/sales
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert salesCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0
testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
-resp_no_certs -nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
--cert ocspCert-self.pem --key ocspKey-self.pem --lifetime 5 --debug 0
testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+3 -2
View File
@@ -5,7 +5,8 @@ cd /etc/ca
echo "Content-type: application/ocsp-response"
echo ""
# we have to use OpenSSL here as pki --ocsp rejects signing with such a
# non-OCSP-signer certificate
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey winnetouKey.pem -rsigner winnetouCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
-nmin 5 -reqin /dev/stdin -respout /dev/stdout | cat
testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey strongswanKey.pem -rsigner strongswanCert.pem \
-resp_no_certs -nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
--key strongswanKey.pem --lifetime 5 --debug 0
testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+2 -4
View File
@@ -8,7 +8,5 @@ echo ""
# simulate a delayed response
sleep 2
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0
testing/tests/ikev2/ocsp-timeouts-unknown/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+2 -4
View File
@@ -8,7 +8,5 @@ echo ""
# simulate a delayed response
sleep 2
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0
testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
--cert ocspCert-self.pem --key ocspKey-self.pem --lifetime 5 --debug 0