test/scripts/5846-DANE-OpenSSL-OCSP/5847

   1 # OCSP stapling under DANE, client
   2 #
   3 #
   4 # ============================================
   5 # Group 1: TLSA (2 1 1) (DANE-TA SPKI SHA2-256)
   6 #
   7 # Client works when we request but don't require OCSP stapling and none comes
   8 exim -bd -oX PORT_D -DSERVER=server -DDETAILS=ta -DRETURN=""
   9 ****
  10 exim -odf norequire@mxdane256tak.test.ex
  11 ****
  12 killdaemon
  13 #
  14 #
  15 #
  16 #
  17 # Client works when we don't request OCSP stapling
  18 exim -bd -oX PORT_D -DSERVER=server -DDETAILS=ta \
  19  -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
  20 ****
  21 exim -odf norequest@mxdane256tak.test.ex
  22 ****
  23 #
  24 #
  25 #
  26 #
  27 # Client accepts good stapled info
  28 exim -odf goodstaple@mxdane256tak.test.ex
  29 ****
  30 killdaemon
  31 #
  32 #
  33 #
  34 # Client fails on lack of required stapled info
  35 exim -bd -oX PORT_D -DSERVER=server -DDETAILS=ta -DRETURN=""
  36 ****
  37 exim -odf nostaple_required@mxdane256tak.test.ex
  38 ****
  39 killdaemon
  40 sudo rm -f spool/db/retry* spool/input/*
  41 #
  42 #
  43 #
  44 # Client fails on revoked stapled info
  45 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server -DDETAILS=ta \
  46  -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp
  47 ****
  48 exim -odf revoked@mxdane256tak.test.ex
  49 ****
  50 killdaemon
  51 sudo rm -f spool/db/retry* spool/input/*
  52 #
  53 #
  54 #
  55 #
  56 # Client fails on expired stapled info
  57 EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server -DDETAILS=ta \
  58  -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp
  59 ****
  60 exim -odf expired@mxdane256tak.test.ex
  61 ****
  62 killdaemon
  63 sudo rm -f spool/db/retry* spool/input/*
  64 #
  65 #
  66 # ============================================
  67 # Group 2: TLSA (2 1 1) (DANE-TA SPKI SHA2-256) but with LE-mode OCSP
  68 #
  69 exim -bd -oX PORT_D -DSERVER=server -DDETAILS=ta \
  70  -DRETURN=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.signernocert.good.resp
  71 ****
  72 #
  73 # Client accepts good stapled info
  74 exim -odf goodstaple_le@mxdane256tak.test.ex
  75 ****
  76 killdaemon
  77 #
  78 no_msglog_check