jstests/ocsp/ocsp_ignore_irrelevant.js
/**
 * Tests OCSP status verification in the server-side (for stapling) ignores
 * the statuses of irrelevant certificates. The server certificate must have
 * the status_request TLS Feature (aka MustStaple) extension for the assertions
 * in this test to work.
 */
Tests OCSP status verification in the server-side (for stapling) ignores
the statuses of irrelevant certificates. The server certificate must have
the status_request TLS Feature (aka MustStaple) extension for the assertions
in this test to work.
Tests OCSP status verification in the server - side ( for stapling ) ignores the statuses of irrelevant certificates . The server certificate must have the status_request TLS Feature ( aka MustStaple ) extension for the assertions in this test to work .
function testStapling(serverCert, caCert, responderCertPair, issuerDigest) {
    jsTestLog("Running stapling test with params: " + JSON.stringify(arguments));
    clearOCSPCache();
    let mock_ocsp =
        new MockOCSPServer("", 32400, responderCertPair, 0, INCLUDE_EXTRA_STATUS, issuerDigest);
    let ocsp_options = {
        sslMode: "requireSSL",
        sslPEMKeyFile: serverCert,
        sslCAFile: caCert,
        sslAllowInvalidHostnames: "",
        setParameter: {
            "ocspEnabled": "true",
        },
        waitForConnect: false,
    };
    let conn = null;
    jsTestLog(
        "Testing server staples a Good status if OCSP response has extraneous statuses and the matching CertID is Good");
    mock_ocsp.start();
    conn = MongoRunner.runMongod(ocsp_options);
    waitForServer(conn);
    assertClientConnectSucceeds(conn);
    MongoRunner.stopMongod(conn);
    sleep(1000);
    mock_ocsp.stop();
    jsTestLog(
        "Testing server staples a revoked status if OCSP response has extraneous statuses and the matching CertID is Revoked");
    Object.extend(ocsp_options, {waitForConnect: false});
    mock_ocsp = new MockOCSPServer(
        FAULT_REVOKED, 32400, responderCertPair, 0, INCLUDE_EXTRA_STATUS, issuerDigest);
    mock_ocsp.start();
    conn = MongoRunner.runMongod(ocsp_options);
    waitForServer(conn);
    assertClientConnectFails(conn, OCSP_REVOKED);
    MongoRunner.stopMongod(conn);
    sleep(1000);
    mock_ocsp.stop();
}
function testStapling ( serverCert , caCert , responderCertPair , issuerDigest ) { jsTestLog ( "Running stapling test with params: " + JSON . stringify ( arguments ) ) ; clearOCSPCache ( ) ; let mock_ocsp = new MockOCSPServer ( "" , 32400 , responderCertPair , 0 , INCLUDE_EXTRA_STATUS , issuerDigest ) ; let ocsp_options = { sslMode : "requireSSL" , sslPEMKeyFile : serverCert , sslCAFile : caCert , sslAllowInvalidHostnames : "" , setParameter : { "ocspEnabled" : "true" , } , waitForConnect : false , } ; let conn = null ; jsTestLog ( "Testing server staples a Good status if OCSP response has extraneous statuses and the matching CertID is Good" ) ; mock_ocsp . start ( ) ; conn = MongoRunner . runMongod ( ocsp_options ) ; waitForServer ( conn ) ; assertClientConnectSucceeds ( conn ) ; MongoRunner . stopMongod ( conn ) ; sleep ( 1000 ) ; mock_ocsp . stop ( ) ; jsTestLog ( "Testing server staples a revoked status if OCSP response has extraneous statuses and the matching CertID is Revoked" ) ; Object . extend ( ocsp_options , { waitForConnect : false } ) ; mock_ocsp = new MockOCSPServer ( FAULT_REVOKED , 32400 , responderCertPair , 0 , INCLUDE_EXTRA_STATUS , issuerDigest ) ; mock_ocsp . start ( ) ; conn = MongoRunner . runMongod ( ocsp_options ) ; waitForServer ( conn ) ; assertClientConnectFails ( conn , OCSP_REVOKED ) ; MongoRunner . stopMongod ( conn ) ; sleep ( 1000 ) ; mock_ocsp . stop ( ) ; }
Tests OCSP status verification in the server-side (for stapling) ignores
 the statuses of irrelevant certificates.
Tests OCSP status verification in the server - side ( for stapling ) ignores the statuses of irrelevant certificates .
// The mongoRunner spawns a new Mongo Object to validate the collections which races // with the shutdown logic of the mock_ocsp responder on some platforms. We need this // sleep to make sure that the threads don't interfere with each other.