Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-01-05 16:29:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #1223

Browse Source 
This PR fixes #1223 by checking whether the stapled OCSP response from the server is an error message.

Another way to fix #1223 would be to just change line 8510 to:
```
if grep -a "OCSP Response Status" <<< "$ocsp_response_status" | grep -q successful || \
     [[ "$ocsp_response" =~ Responder\ Error: ]]; then 
```
However, I believe this alternative would lead to confusing results, testssl.sh would print

     offered, error querying OCSP responder (tryLater)

I'm not sure whether it makes sense to say "offered" when the stapled response that is provided is just an error message, but I think it is important to make clear that the error response was received from the TLS server, and that it wasn't testssl.sh that tried querying the OCSP responder.
This commit is contained in:
David Cooper 2019-04-01 14:21:45 -04:00 committed by GitHub
parent 4b05e39133
commit 9d2061fdf9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
testssl.sh
View File

@ -7808,6 +7808,7 @@ certificate_info() {
local days2warn1=$DAYS2WARN1
local provides_stapling=false
local caa_node="" all_caa="" caa_property_name="" caa_property_value=""
local response=""
if [[ $number_of_certificates -gt 1 ]]; then
[[ $certificate_number -eq 1 ]] && outln
@ -8511,6 +8512,10 @@ certificate_info() {
fileout "${jsonID}${json_postfix}" "OK" "offered"
provides_stapling=true
check_revocation_ocsp "" "$ocsp_response_binary" "cert_ocspRevoked${json_postfix}"
elif [[ "$ocsp_response" =~ Responder\ Error: ]]; then
response="$(awk '/Responder Error:/ { print $3 }' <<< "$ocsp_response")"
pr_warning "stapled OCSP response contained an error response from OCSP responder: $response"
fileout "${jsonID}${json_postfix}" "WARN" "stapled OCSP response contained an error response from OCSP responder: $response"
else
if $GOST_STATUS_PROBLEM; then
pr_warning "(GOST servers make problems here, sorry)"