Change #286542

Comments

cert-status: tests and fixes

Add test_24 for checking OCSP stapling responses for a test certificate
delivered via `openssl s_server`.

- fix gnutls edge cases that escape the default verification
  implemented by gnuTLS itself
- openssl: use the "verified cert chain" and not the "peer chain"
  to check OCSP trust. The difference is that the former includes
  the anchor certificate. For public certificates this will mostly
  not matter as OCSP is rarely signed by a root cert, but for
  private CAs this might happen.

Closes #23420

Changed files

• lib/vtls/gtls.c
• lib/vtls/openssl.c
• tests/http/Makefile.am
• tests/http/test_24_ocsp.py
• tests/http/testenv/certs.py