starred/certbot-certbot-1
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-02 03:22:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Better error handling

Browse Source
This commit is contained in:
Peter Eckersley
2016-12-21 14:38:26 -08:00
parent fe36e336a8
commit 7a18a124ce
3 changed files with 45 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot/ocsp.py
+40 -21
View File
@@ -24,50 +24,69 @@ def revoked_status(cert_path, chain_path):
"""
url, _ = util.run_script(
["openssl", "x509", "-in", cert_path, "-noout", "-ocsp_uri"])
if revoked_status.broken:
return False
if not util.exe_exists("openssl"):
logging.info("openssl not installed, can't check revocation")
revoked_status.broken = True
return False
try:
url, err = util.run_script(
["openssl", "x509", "-in", cert_path, "-noout", "-ocsp_uri"],
log=logging.debug)
except errors.SubprocessError:
logger.info("Cannot extract OCSP URI from %s", cert_path)
return False
url = url.rstrip()
host = url.partition("://")[2].rstrip("/")
if not host:
raise errors.Error(
"Unable to get OCSP host from cert, url - %s", url)
logger.info("Cannot process OCSP host from URL (%s) in cert at %s", url, cert_path)
return False
# New versions of openssl want -header var=val, old ones want -header var val
test_host_format = Popen(["openssl", "ocsp", "-header", "var", "val"],
stdout=PIPE, stderr=PIPE)
_out, err = test_host_format.communicate()
if "Missing =" in err:
host_arg = ["Host=" + host]
host_args = ["Host=" + host]
else:
host_arg = ["Host", host]
host_args = ["Host", host]
# jdkasten thanks "Bulletproof SSL and TLS - Ivan Ristic" for documenting this!
try:
output, _ = util.run_script(
["openssl", "ocsp",
"-no_nonce",
"-header"] + host_arg + [
"-issuer", chain_path,
"-cert", cert_path,
"-url", url,
"-CAfile", chain_path,
"-verify_other", chain_path])
cmd = ["openssl", "ocsp",
"-no_nonce",
"-issuer", chain_path,
"-cert", cert_path,
"-url", url,
"-CAfile", chain_path,
"-verify_other", chain_path,
"-header"] + host_args
output, err = util.run_script(cmd, log=logging.debug)
except errors.SubprocessError:
return "OCSP Failure"
logger.info("OCSP querying seems to be broken, assuming nothing is revoked...")
logger.debug("Command was:\n%s\nError was:\n%s", " ".join(cmd), err)
revoked_status.broken = True
return False
return _translate_ocsp_query(cert_path, output)
return _translate_ocsp_query(cert_path, output, err)
revoked_status.broken = False
def _translate_ocsp_query(cert_path, ocsp_output):
def _translate_ocsp_query(cert_path, ocsp_output, ocsp_errors):
"""Returns a label string out of the query."""
if not "Response verify OK":
return "Revocation Unknown"
logger.info("Revocation status for %s is unknown", cert_path)
logger.debug("Uncertain ouput:\n%s\nstderr:\n%s", ocsp_output, ocsp_errors)
return ""
if cert_path + ": good" in ocsp_output:
return ""
elif cert_path + ": revoked" in ocsp_output:
return REV_LABEL
else:
raise errors.Error(
"Unable to properly parse OCSP output: %s", ocsp_output)
logger.warn("Unable to properly parse OCSP output: %s", ocsp_output)
return ""