Plug the logic to tests

certbot-ci/certbot_integration_tests/certbot_tests/test_main.py

@@ -3,6 +3,7 @@ from __future__ import print_function
 
 import os
 import re
+import requests
 import shutil
 import subprocess
 import time
@@ -555,23 +556,35 @@ def test_ocsp_status_stale(context):
 
 def test_ocsp_status_live(context):
     """Test retrieval of OCSP statuses for live config"""
+    mock_ocsp_server = None
     if context.acme_server == 'pebble':
-        pytest.skip('Pebble does not support OCSP status requests.')
+        mock_ocsp_server = misc.mock_ocsp_server(context.directory_url, context.workspace)
 
-    # OSCP 1: Check live certificate OCSP status (VALID)
     cert = context.get_domain('ocsp-check')
-    context.certbot(['--domains', cert])
-    output = context.certbot(['certificates'])
+    cert_path = join(context.config_dir, 'live', cert, 'cert.pem')
 
-    assert output.count('VALID') == 1, 'Expected {0} to be VALID'.format(cert)
-    assert output.count('EXPIRED') == 0, 'Did not expect {0} to be EXPIRED'.format(cert)
+    try:
+        # OSCP 1: Check live certificate OCSP status (VALID)
+        context.certbot(['--domains', cert])
+        if mock_ocsp_server:
+            requests.put(mock_ocsp_server[1], json={'cert_path': cert_path, 'ocsp_status': 'GOOD'})
+        output = context.certbot(['certificates'])
 
-    # OSCP 2: Check live certificate OCSP status (REVOKED)
-    context.certbot(['revoke', '--cert-name', cert, '--no-delete-after-revoke'])
-    # Sometimes in oldest tests (using openssl binary and not cryptography), the OCSP status is
-    # not seen immediately by Certbot as invalid. Waiting few seconds solves this transient issue.
-    time.sleep(5)
-    output = context.certbot(['certificates'])
+        assert output.count('VALID') == 1, 'Expected {0} to be VALID'.format(cert)
+        assert output.count('EXPIRED') == 0, 'Did not expect {0} to be EXPIRED'.format(cert)
 
-    assert output.count('INVALID') == 1, 'Expected {0} to be INVALID'.format(cert)
-    assert output.count('REVOKED') == 1, 'Expected {0} to be REVOKED'.format(cert)
+        # OSCP 2: Check live certificate OCSP status (REVOKED)
+        context.certbot(['revoke', '--cert-name', cert, '--no-delete-after-revoke'])
+        if mock_ocsp_server:
+            requests.put(mock_ocsp_server[1], json={'cert_path': cert_path, 'ocsp_status': 'REVOKED'})
+        # Sometimes in oldest tests (using openssl binary and not cryptography), the OCSP status is
+        # not seen immediately by Certbot as invalid. Waiting few seconds solves this transient issue.
+        time.sleep(5)
+        output = context.certbot(['certificates'])
+
+        assert output.count('INVALID') == 1, 'Expected {0} to be INVALID'.format(cert)
+        assert output.count('REVOKED') == 1, 'Expected {0} to be REVOKED'.format(cert)
+    finally:
+        if mock_ocsp_server:
+            mock_ocsp_server[0].terminate()
+            mock_ocsp_server[0].wait()

certbot-ci/certbot_integration_tests/utils/misc.py

@@ -293,7 +293,6 @@ def load_sample_data_path(workspace):
     return copied
 
 
-@contextlib.contextmanager
 def mock_ocsp_server(directory_url, workspace):
     root_url = directory_url.replace('/dir', '')
 
@@ -309,8 +308,5 @@ def mock_ocsp_server(directory_url, workspace):
     environ['ISSUER_CERT_PATH'] = cert_path
 
     process = subprocess.Popen([sys.executable, ocsp_server.__file__], env=environ)
-    try:
-        yield 'http://127.0.0.1:{0}'.format(MOCK_OCSP_SERVER_PORT)
-    finally:
-        process.terminate()
-        process.wait()
+
+    return process, 'http://127.0.0.1:{0}'.format(MOCK_OCSP_SERVER_PORT)