Re: [exim-dev] Exim OCSP stapling

Top Page
Delete this message
Reply to this message
Author: Jeremy Harris
Date:  
To: exim-dev
Subject: Re: [exim-dev] Exim OCSP stapling
Separately from the implementation, I have a testing
problem with the OCSP stuff. I want to verify that,
server side, exim refuses to send out out-of-date staplings.

So far, so easy.

But I also want to verify that, client-side, exim properly rejects
a connection where the server staples outdated (or revoked)
info. I can do that by making the server-side check depend
on running_in_test_harness - but that means I can't do the
server-side testing with the same build of exim.

I'm not aware of a convenient utility that talks all of
ESMTP, STARTTLS and OCSP, server side. Any runtime
ways anyone can think of to defeat the "don't staple bogus info"
test? Any way of pointing the testsuite to a "normal" binary
(vs. the running_in_test_harness one)?

-- 
Thanks,
     Jeremy