a4156cded3
With OpenSSL <= 1.0.1, openssl ocsp command still returns exit code 0, even if verification was failed. If that happens certain string is emitted in stderr, so check that string and if exists, treat it as error. This issue was fixed in OpenSSL 1.0.2. At least OpenSSL 1.0.2, openssl ocsp command still returns exit code 0, even if responder returned non-successful status code (e.g., trylater(3)). We are not sure this is intentional or not. To handle this, we again check certain error string in stdout, and if it is found, treat it as error. |
||
|---|---|---|
| .. | ||
| Makefile.am | ||
| README.rst | ||
| fetch-ocsp-response | ||
README.rst
fetch-ocsp-response is a Python script which performs OCSP query and get response. It uses openssl command under the hood. nghttpx uses it to enable OCSP stapling feature. fetch-ocsp-response is a translation from original fetch-ocsp-response written in Perl and which has been developed as part of h2o project (https://github.com/h2o/h2o). fetch-ocsp-response is usually installed under $(pkgdatadir), which is $(prefix)/share/nghttp2.