960723 - test_ev_certs.js: failingOCSPResponder doesn't fail properly

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Without setting the server's identities to "www.example.com" and "crl.example.com", it will just return 400 (bad request) to any requests made to these hosts, and it will not run the registered prefix handler that causes the test to fail. Fixing this also uncovered an issue in the case where the EE cert doesn't have an OCSP url; it turns out libpkix will make an OCSP request for the intermediate before getting to the EE.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: 960723-failingOCSPResponder.diff

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 8361298 [details] [diff] [review]
960723-failingOCSPResponder.diff

Review of attachment 8361298 [details] [diff] [review]:
-----------------------------------------------------------------

I guess you could say...
(•_•)
( •_•)>⌐■-■
(⌐■_■)
I don't know how to write code that fails.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

My only response is this: http://mirrors.rit.edu/instantCSI/ (requires flash, unfortunately. Maybe I'll make an html5 one...)
Thanks for the quick review.
https://hg.mozilla.org/integration/mozilla-inbound/rev/a2d581209387

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a2d581209387