Work in progress

certbot-ci/certbot_integration_tests/certbot_tests/context.py

@@ -4,7 +4,7 @@ import shutil
 import sys
 import tempfile
 
-from certbot_integration_tests.utils import misc, certbot_call
+from certbot_integration_tests.utils import certbot_call
 
 
 class IntegrationTestsContext(object):

certbot-ci/certbot_integration_tests/utils/misc.py

@@ -24,6 +24,16 @@ from cryptography.hazmat.primitives.serialization import Encoding, PrivateFormat
 from six.moves import socketserver, SimpleHTTPServer
 
 
+from certbot_integration_tests.utils import ocsp_server
+
+try:
+    import urllib3
+    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+except ImportError:
+    # Handle old versions of request with vendorized urllib3
+    from requests.packages.urllib3.exceptions import InsecureRequestWarning
+    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
+
 RSA_KEY_TYPE = 'rsa'
 ECDSA_KEY_TYPE = 'ecdsa'
 
@@ -35,14 +45,6 @@ def check_until_timeout(url):
     :param str url: the URL to test
     :raise ValueError: exception raised after 150 unsuccessful attempts to reach the URL
     """
-    try:
-        import urllib3
-        urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
-    except ImportError:
-        # Handle old versions of request with vendorized urllib3
-        from requests.packages.urllib3.exceptions import InsecureRequestWarning
-        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
-
     for _ in range(0, 150):
         time.sleep(1)
         try:
@@ -288,3 +290,27 @@ def load_sample_data_path(workspace):
     copied = os.path.join(workspace, 'sample-config')
     shutil.copytree(original, copied, symlinks=True)
     return copied
+
+
+@contextlib.contextmanager
+def mock_ocsp_server(directory_url, workspace):
+    root_url = directory_url.replace('/dir', '')
+
+    key_path = os.path.join(workspace, 'ocsp_key.pem')
+    cert_path = os.path.join(workspace, 'ocsp_cert.pem')
+    with open(key_path, 'w') as file_h:
+        file_h.write(requests.get(root_url + '/intermediate-key', verify=False).content)
+    with open(cert_path, 'w') as file_h:
+        file_h.write(requests.get(root_url + '/intermediate', verify=False).content)
+
+    environ = os.environ.copy()
+    environ['ISSUER_KEY_PATH'] = key_path
+    environ['ISSUER_CERT_PATH'] = cert_path
+    environ['OCSP_PORT'] = '4002'
+
+    process = subprocess.Popen([sys.executable, ocsp_server.__file__], env=environ)
+    try:
+        yield 'http://127.0.0.1:4002'
+    finally:
+        process.terminate()
+        process.wait()

certbot-ci/certbot_integration_tests/utils/ocsp_server.py

@@ -11,11 +11,6 @@ from flask import Flask, request
 app = Flask(__name__)
 app.debug = False
 
-with open(os.environ['ISSUER_CERT_PATH'], 'rb') as file_h1:
-    issuer_cert = x509.load_pem_x509_certificate(file_h1.read(), default_backend())
-with open(os.environ['ISSUER_KEY_PATH'], 'rb') as file_h2:
-    issuer_key = serialization.load_pem_private_key(file_h2.read(), None, default_backend())
-
 certificates_map = {}
 
 
@@ -52,6 +47,10 @@ def status_certificate():
         cert_path = config[0]
         ocsp_status = getattr(ocsp.OCSPCertStatus, config[1])
 
+        with open(os.environ['ISSUER_CERT_PATH'], 'rb') as file_h1:
+            issuer_cert = x509.load_pem_x509_certificate(file_h1.read(), default_backend())
+        with open(os.environ['ISSUER_KEY_PATH'], 'rb') as file_h2:
+            issuer_key = serialization.load_pem_private_key(file_h2.read(), None, default_backend())
         with open(cert_path, 'rb') as file_h3:
             cert = x509.load_pem_x509_certificate(file_h3.read(), default_backend())
 
@@ -70,4 +69,4 @@ def status_certificate():
 
 
 if __name__ == '__main__':
-    app.run(host='0.0.0.0', port=4002)
+    app.run(host='0.0.0.0', port=int(os.environ.get('OCSP_PORT', 4002)))