mirror of
				https://github.com/drwetter/testssl.sh.git
				synced 2025-10-30 21:35:26 +01:00 
			
		
		
		
	Add host header to OCSP Request
Some OCSP responder seems to need a host header, see e.g. https://blog.ivanristic.com/2014/02/checking-ocsp-revocation-using-openssl.html . This commit adds this header. It addresses not all errors though. E.g. "https://testssl.sh" is fine now, "https://google.com" still returns "Code=400,Reason=Bad Request" which needs further investigation, Also this commit gives a warning if the OCSP request fails (fileout needs to be added)
This commit is contained in:
		
							
								
								
									
										16
									
								
								testssl.sh
									
									
									
									
									
								
							
							
						
						
									
										16
									
								
								testssl.sh
									
									
									
									
									
								
							| @@ -1501,8 +1501,8 @@ check_revocation_ocsp() { | |||||||
|  |  | ||||||
|      "$PHONE_OUT" || return 0 |      "$PHONE_OUT" || return 0 | ||||||
|      tmpfile=$TEMPDIR/${NODE}-${NODEIP}.${uri##*\/} || exit $ERR_FCREATE |      tmpfile=$TEMPDIR/${NODE}-${NODEIP}.${uri##*\/} || exit $ERR_FCREATE | ||||||
|      $OPENSSL ocsp -no_nonce -url "$uri" -issuer $TEMPDIR/hostcert_issuer.pem \ |      $OPENSSL ocsp -no_nonce -header Host ${uri##http://} -url "$uri" \ | ||||||
|           -verify_other $TEMPDIR/intermediatecerts.pem \ |           -issuer $TEMPDIR/hostcert_issuer.pem -verify_other $TEMPDIR/intermediatecerts.pem  \ | ||||||
|           -CAfile $TEMPDIR/intermediatecerts.pem -cert $HOSTCERT &> "$tmpfile" |           -CAfile $TEMPDIR/intermediatecerts.pem -cert $HOSTCERT &> "$tmpfile" | ||||||
|      if [[ $? -eq 0 ]] && grep -q "Response verify OK" "$tmpfile"; then |      if [[ $? -eq 0 ]] && grep -q "Response verify OK" "$tmpfile"; then | ||||||
|           if grep -q "$HOSTCERT: good" "$tmpfile"; then |           if grep -q "$HOSTCERT: good" "$tmpfile"; then | ||||||
| @@ -1517,9 +1517,15 @@ check_revocation_ocsp() { | |||||||
|                outln |                outln | ||||||
|                cat "$tmpfile" |                cat "$tmpfile" | ||||||
|           fi |           fi | ||||||
|      elif [[ $DEBUG -ge 2 ]]; then |      else | ||||||
|           outln |           out ", " | ||||||
|           cat "$tmpfile" |           pr_warning "error querying OCSP responder" | ||||||
|  |           if [[ $DEBUG -ge 2 ]]; then | ||||||
|  |                outln | ||||||
|  |                cat "$tmpfile" | ||||||
|  |           else | ||||||
|  |                out " (--debug >= 2 shows reason)" | ||||||
|  |           fi | ||||||
|      fi |      fi | ||||||
| } | } | ||||||
|  |  | ||||||
|   | |||||||
		Reference in New Issue
	
	Block a user
	 Dirk
					Dirk