denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

testing: Use pki --ocsp as OCSP responder

Browse Source 
The only exception is the ikev2/ocsp-no-signer-cert scenario as the
pki command won't sign an OCSP response with a certificate that isn't
the CA certificate or marked as an OCSP signer.
This commit is contained in:
Tobias Brunner
2023-11-13 12:50:47 +01:00
parent 5764e1e506
commit c10a13589e
9 changed files with 19 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/hosts/winnetou/etc/ca/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert strongswanCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0
testing/hosts/winnetou/etc/ca/research/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca/research
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert researchCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0
testing/hosts/winnetou/etc/ca/sales/ocsp/ocsp.cgi
+2 -4
View File
@@ -5,7 +5,5 @@ cd /etc/ca/sales
echo "Content-type: application/ocsp-response"
echo ""
cat | /usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
-rkey ocspKey.pem -rsigner ocspCert.pem \
-nmin 5 \
-reqin /dev/stdin -respout /dev/stdout | cat
cat | pki --ocsp --respond --cacert salesCert.pem --index index.txt \
--cert ocspCert.pem --key ocspKey.pem --lifetime 5 --debug 0