mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-06 00:39:44 +01:00
Add host header to OCSP Request
Some OCSP responder seems to need a host header, see e.g. https://blog.ivanristic.com/2014/02/checking-ocsp-revocation-using-openssl.html . This commit adds this header. It addresses not all errors though. E.g. "https://testssl.sh" is fine now, "https://google.com" still returns "Code=400,Reason=Bad Request" which needs further investigation, Also this commit gives a warning if the OCSP request fails (fileout needs to be added)
This commit is contained in:
parent
567cc05fca
commit
fac65d82b0
16
testssl.sh
16
testssl.sh
@ -1501,8 +1501,8 @@ check_revocation_ocsp() {
|
|||||||
|
|
||||||
"$PHONE_OUT" || return 0
|
"$PHONE_OUT" || return 0
|
||||||
tmpfile=$TEMPDIR/${NODE}-${NODEIP}.${uri##*\/} || exit $ERR_FCREATE
|
tmpfile=$TEMPDIR/${NODE}-${NODEIP}.${uri##*\/} || exit $ERR_FCREATE
|
||||||
$OPENSSL ocsp -no_nonce -url "$uri" -issuer $TEMPDIR/hostcert_issuer.pem \
|
$OPENSSL ocsp -no_nonce -header Host ${uri##http://} -url "$uri" \
|
||||||
-verify_other $TEMPDIR/intermediatecerts.pem \
|
-issuer $TEMPDIR/hostcert_issuer.pem -verify_other $TEMPDIR/intermediatecerts.pem \
|
||||||
-CAfile $TEMPDIR/intermediatecerts.pem -cert $HOSTCERT &> "$tmpfile"
|
-CAfile $TEMPDIR/intermediatecerts.pem -cert $HOSTCERT &> "$tmpfile"
|
||||||
if [[ $? -eq 0 ]] && grep -q "Response verify OK" "$tmpfile"; then
|
if [[ $? -eq 0 ]] && grep -q "Response verify OK" "$tmpfile"; then
|
||||||
if grep -q "$HOSTCERT: good" "$tmpfile"; then
|
if grep -q "$HOSTCERT: good" "$tmpfile"; then
|
||||||
@ -1517,9 +1517,15 @@ check_revocation_ocsp() {
|
|||||||
outln
|
outln
|
||||||
cat "$tmpfile"
|
cat "$tmpfile"
|
||||||
fi
|
fi
|
||||||
elif [[ $DEBUG -ge 2 ]]; then
|
else
|
||||||
outln
|
out ", "
|
||||||
cat "$tmpfile"
|
pr_warning "error querying OCSP responder"
|
||||||
|
if [[ $DEBUG -ge 2 ]]; then
|
||||||
|
outln
|
||||||
|
cat "$tmpfile"
|
||||||
|
else
|
||||||
|
out " (--debug >= 2 shows reason)"
|
||||||
|
fi
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user