Repository navigation
ocsp: match openssl ocsp client output and exit status - #302
Open
julek-wolfssl wants to merge 2 commits into
Open
julek-wolfssl wants to merge 2 commits into
julek-wolfssl wants to merge 2 commits into
Conversation
Print the certificate status on stdout the way openssl ocsp does: "<cert>: good|revoked|unknown" followed by This Update, Next Update and, for revoked certificates, Reason and Revocation Time. Exit 0 for any verified status, including revoked and unknown, and print openssl's "Responder Error" line when the responder returns an error status. Previously the status line went to stderr and an unknown status was reported as an error. The client drives the exchange with the native API: wc_InitOcspRequest and wc_EncodeOcspRequest build the request, EmbedOcspLookup sends it and wolfSSL_CertManagerCheckOCSPResponse verifies the response and returns the matched CertStatus, which supplies the status details. Dates are formatted from wc_GetDateAsCalendarTime. F-12945
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The implementation omits valid revocation reasons and introduces dependencies on APIs unavailable without OPENSSL_EXTRA.
2 open findings
What changed in this PR
Aligns the wolfCLU OCSP client’s output and exit behavior with OpenSSL.
Changes:
- Uses native OCSP request, transport, and verification APIs.
- Prints verified certificate details to stdout.
- Adds coverage and documentation for good, revoked, unknown, and responder-error results.
| File | Description |
|---|---|
src/ocsp/clu_ocsp.c |
Implements request exchange and compatible status output. |
tests/ocsp/ocsp-test.py |
Tests statuses, output streams, and responder errors. |
manpages/wolfssl-ocsp.1 |
Documents output and exit behavior. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+357
to
+358
| wolfSSL_BIO_printf(bio, "%s: %s\n", name, | ||
| wolfSSL_OCSP_cert_status_str(cs->status)); |
Comment on lines
+312
to
+315
| case WC_CRL_REASON_REMOVE_FROM_CRL: | ||
| return "removeFromCRL"; | ||
| default: | ||
| return "(UNKNOWN)"; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OCSP client now prints the certificate status and exits the way
openssl ocspdoes.<cert>: good|revoked|unknownon stdout, followed by This Update, Next Update and, for revoked certificates, Reason and Revocation Time. Previously the status line went to stderr.The client uses the native API for the exchange:
wc_InitOcspRequestandwc_EncodeOcspRequestbuild the request,EmbedOcspLookupsends it, andwolfSSL_CertManagerCheckOCSPResponseverifies the response and returns the matched CertStatus, which supplies the status details. Dates are formatted fromwc_GetDateAsCalendarTime.Ref: F-12945