Continue work

certbot-ci/certbot_integration_tests/utils/acme_server.py

@@ -134,7 +134,7 @@ class ACMEServer(object):
             [challtestsrv_path, '-management', ':{0}'.format(CHALLTESTSRV_PORT), '-defaultIPv6', '""',
              '-defaultIPv4', '127.0.0.1', '-http01', '""', '-tlsalpn01', '""', '-https01', '""'])
 
-        self._launch_process([sys.executable, ocsp_server.__file__])
+        #self._launch_process([sys.executable, ocsp_server.__file__])
 
         # Wait for the ACME CA server to be up.
         print('=> Waiting for pebble instance to respond...')

certbot-ci/certbot_integration_tests/utils/ocsp_server.py

@@ -1,5 +1,4 @@
 import datetime
-import sys
 from dateutil import parser
 
 import requests
@@ -17,10 +16,10 @@ from certbot_integration_tests.utils.constants import MOCK_OCSP_SERVER_PORT, PEB
 def _create_ocsp_handler():
     class ProxyHandler(BaseHTTPServer.BaseHTTPRequestHandler):
         def do_POST(self):
-            request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate-key', verify=False)
+            request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate-keys/0', verify=False)
             issuer_key = serialization.load_pem_private_key(request.content, None, default_backend())
 
-            request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate', verify=False)
+            request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediates/0', verify=False)
             issuer_cert = x509.load_pem_x509_certificate(request.content, default_backend())
 
             try:
@@ -28,31 +27,39 @@ def _create_ocsp_handler():
             except AttributeError:
                 content_len = int(self.headers.get('Content-Length'))
 
-            cert = x509.load_pem_x509_certificate(self.rfile.read(content_len), default_backend())
-            request = requests.get('{0}/cert-status-by-serial/{1}'.format(
-                PEBBLE_MANAGEMENT_URL, str(hex(cert.serial_number)).replace('0x', '')), verify=False)
-            data = request.json()
+            ocsp_request = ocsp.load_der_ocsp_request(self.rfile.read(content_len))
+            response = requests.get('{0}/cert-status-by-serial/{1}'.format(
+                PEBBLE_MANAGEMENT_URL, str(hex(ocsp_request.serial_number)).replace('0x', '')), verify=False)
 
-            ocsp_status = getattr(ocsp.OCSPCertStatus, data['Status'].upper())
+            if not response.ok:
+                ocsp_response = ocsp.OCSPResponseBuilder.build_unsuccessful(ocsp.OCSPResponseStatus.UNAUTHORIZED)
+            else:
+                data = response.json()
 
-            now = datetime.datetime.utcnow()
-            revocation_time = parser.parse(data['RevokedAt']) if ocsp_status == ocsp.OCSPCertStatus.REVOKED else None
-            revocation_reason = x509.ReasonFlags.unspecified if ocsp_status == ocsp.OCSPCertStatus.REVOKED else None
+                now = datetime.datetime.utcnow()
+                cert = x509.load_pem_x509_certificate(data['Certificate'].encode(), default_backend())
+                if data['Status'] != 'Revoked':
+                    ocsp_status, revocation_time, revocation_reason = ocsp.OCSPCertStatus.GOOD, None, None
+                else:
+                    ocsp_status, revocation_reason = ocsp.OCSPCertStatus.REVOKED, x509.ReasonFlags.unspecified
+                    print('time is')
+                    print(data['RevokedAt'])
+                    revocation_time = parser.parse(data['RevokedAt'])
 
-            builder = ocsp.OCSPResponseBuilder()
-            builder = builder.add_response(
-                cert=cert, issuer=issuer_cert, algorithm=hashes.SHA1(),
-                cert_status=ocsp_status,
-                this_update=now,
-                next_update=now + datetime.timedelta(hours=1),
-                revocation_time=revocation_time, revocation_reason=revocation_reason
-            ).responder_id(ocsp.OCSPResponderEncoding.NAME, issuer_cert)
+                builder = ocsp.OCSPResponseBuilder()
+                builder = builder.add_response(
+                    cert=cert, issuer=issuer_cert, algorithm=hashes.SHA1(),
+                    cert_status=ocsp_status,
+                    this_update=now,
+                    next_update=now + datetime.timedelta(hours=1),
+                    revocation_time=revocation_time, revocation_reason=revocation_reason
+                ).responder_id(ocsp.OCSPResponderEncoding.NAME, issuer_cert)
 
-            response = builder.sign(issuer_key, hashes.SHA256())
+                ocsp_response = builder.sign(issuer_key, hashes.SHA256())
 
             self.send_response(200)
             self.end_headers()
-            self.wfile.write(response.public_bytes(serialization.Encoding.DER))
+            self.wfile.write(ocsp_response.public_bytes(serialization.Encoding.DER))
 
     return ProxyHandler
 

certbot-ci/certbot_integration_tests/utils/pebble_artifacts.py

@@ -44,6 +44,7 @@ def _build_pebble_config(workspace):
         file_h.write(json.dumps({
             'pebble': {
                 'listenAddress': '0.0.0.0:14000',
+                'managementListenAddress': '0.0.0.0:15000',
                 'certificate': os.path.join(ASSETS_PATH, 'cert.pem'),
                 'privateKey': os.path.join(ASSETS_PATH, 'key.pem'),
                 'httpPort': 5002,