Fix OCSP Tests (#17114) - #17115
Fix OCSP Tests (#17114)#17115chrisvest wants to merge 1 commit into
Conversation
Sorry, something went wrong.
Motivation: Google Trust Services, which supply the SSL certificate for `netty.io`, recently stopped adding OCSP entries to the certificates they create. This broke some of our OCSP tests, which were relying on reaching out to netty.io and checking the certificate. Modification: Change the test domain to instead use `apple.com`, which still adds OCSP entries to their certificates. Result: This makes the tests pass again as a temporary measure. The real fix is to add OCSP support to our netty-pkitesting module, and instead rely entirely on local connections with certificates fully controlled by the test setup. (cherry picked from commit 7aa3f1f)
|
@hyperxpro Can you look into why this is failing? The only difference between this and 4.2 that I can think of, is the BouncyCastle version, but the signature verification (which is where this is failing) delegates to the JDK provider. Maybe TBSResponseData in this version of BouncyCastle isn't round-trip encoding safe and create a different binary encoding which fails the signature check. |
Sorry, something went wrong.
I'll take a look tomorrow for sure. |
Sorry, something went wrong.
|
Found: #16119 We need this on 4.1 branch. Is it fine if I make the PR? |
Sorry, something went wrong.
Oh! Yeah, looks like we didn't backport that change. Yes, please make a PR. You can make a combined PR with both backports. |
Sorry, something went wrong.
|
Ack - I will take care then :) |
Sorry, something went wrong.
Motivation:
Google Trust Services, which supply the SSL certificate for netty.io, recently stopped adding OCSP entries to the certificates they create.
This broke some of our OCSP tests, which were relying on reaching out to netty.io and checking the certificate.
Modification:
Change the test domain to instead use apple.com, which still adds OCSP entries to their certificates.
Result:
This makes the tests pass again as a temporary measure. The real fix is to add OCSP support to our netty-pkitesting module, and instead rely entirely on local connections with certificates fully controlled by the test setup.
(cherry picked from commit 7aa3f1f)