starred/certbot-certbot-1
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-02 03:22:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Start handling some weirder OCSP states

Browse Source
This commit is contained in:
Peter Eckersley
2016-12-22 18:51:17 -08:00
parent aaffe2f9ca
commit 0011a3b7d8
2 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot/ocsp.py
+10 -3
View File
@@ -1,5 +1,6 @@
"""Tools for checking certificate revocation."""
import logging
import re
from subprocess import Popen, PIPE
@@ -95,15 +96,21 @@ class RevocationChecker(object):
def _translate_ocsp_query(cert_path, ocsp_output, ocsp_errors):
"""Parse openssl's weird output to work out what it means."""
if not "Response verify OK" in ocsp_errors:
pattern = r"{0}: (WARNING.*)good".format(cert_path)
good = re.search(pattern, ocsp_output, flags=re.DOTALL)
warning = good.group(1) if good else None
if (not "Response verify OK" in ocsp_errors) or (good and warning):
logger.info("Revocation status for %s is unknown", cert_path)
logger.debug("Uncertain ouput:\n%s\nstderr:\n%s", ocsp_output, ocsp_errors)
return False
if cert_path + ": good" in ocsp_output:
if good and not warning:
return False
elif cert_path + ": revoked" in ocsp_output:
return True
else:
logger.warn("Unable to properly parse OCSP output: %s", ocsp_output)
logger.warn("Unable to properly parse OCSP output: %s\nstderr:%s",
ocsp_output, ocsp_errors)
return False