starred/certbot-certbot-1
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-02 03:22:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Explicitly handle "unknown" responses from openssl

Browse Source
This commit is contained in:
Peter Eckersley
2017-01-05 12:06:51 -08:00
parent 3c757aec9b
commit 707b27418f
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot/ocsp.py
+3 -1
View File
@@ -98,11 +98,13 @@ def _translate_ocsp_query(cert_path, ocsp_output, ocsp_errors):
pattern = r"{0}: (WARNING.*)?good".format(cert_path)
rpattern = r"{0}: (WARNING.*)?revoked".format(cert_path)
upattern = r"{0}: (WARNING.*)?unknown".format(cert_path)
good = re.search(pattern, ocsp_output, flags=re.DOTALL)
revoked = re.search(rpattern, ocsp_output, flags=re.DOTALL)
unknown = re.search(upattern, ocsp_output, flags=re.DOTALL)
warning = good.group(1) if good else None
if (not "Response verify OK" in ocsp_errors) or (good and warning):
if (not "Response verify OK" in ocsp_errors) or (good and warning) or unknown:
logger.info("Revocation status for %s is unknown", cert_path)
logger.debug("Uncertain output:\n%s\nstderr:\n%s", ocsp_output, ocsp_errors)
return False