ocsp-stapling2.test 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491
  1. #!/bin/bash
  2. # ocsp-stapling2.test
  3. # Test requires HAVE_OCSP and HAVE_CERTIFICATE_STATUS_REQUEST_V2
  4. SCRIPT_DIR="$(dirname "$0")"
  5. # if we can, isolate the network namespace to eliminate port collisions.
  6. if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
  7. if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
  8. export NETWORK_UNSHARE_HELPER_CALLED=yes
  9. exec "$NETWORK_UNSHARE_HELPER" "$0" "$@" || exit $?
  10. fi
  11. elif [ "${AM_BWRAPPED-}" != "yes" ]; then
  12. bwrap_path="$(command -v bwrap)"
  13. if [ -n "$bwrap_path" ]; then
  14. export AM_BWRAPPED=yes
  15. exec "$bwrap_path" --unshare-net --dev-bind / / "$0" "$@"
  16. fi
  17. unset AM_BWRAPPED
  18. fi
  19. if [[ -z "${RETRIES_REMAINING-}" ]]; then
  20. export RETRIES_REMAINING=2
  21. fi
  22. if ! ./examples/client/client -V | grep -q 3; then
  23. echo 'skipping ocsp-stapling2.test because TLS1.2 is not available.' 1>&2
  24. exit 77
  25. fi
  26. if openssl s_server -help 2>&1 | fgrep -q -i ipv6 && nc -h 2>&1 | fgrep -q -i ipv6; then
  27. IPV6_SUPPORTED=yes
  28. else
  29. IPV6_SUPPORTED=no
  30. fi
  31. if ./examples/client/client '-#' | fgrep -q -e ' -DTEST_IPV6 '; then
  32. if [[ "$IPV6_SUPPORTED" == "no" ]]; then
  33. echo 'Skipping IPV6 test in environment lacking IPV6 support.'
  34. exit 0
  35. fi
  36. LOCALHOST='[::1]'
  37. LOCALHOST_FOR_NC='-6 ::1'
  38. else
  39. LOCALHOST='127.0.0.1'
  40. LOCALHOST_FOR_NC='127.0.0.1'
  41. fi
  42. PARENTDIR="$PWD"
  43. # create a unique workspace directory ending in PID for the script instance ($$)
  44. # to make this instance orthogonal to any others running, even on same repo.
  45. # TCP ports are also carefully formed below from the PID, to minimize conflicts.
  46. WORKSPACE="${PARENTDIR}/workspace.pid$$"
  47. mkdir "${WORKSPACE}" || exit $?
  48. cp -pR ${SCRIPT_DIR}/../certs "${WORKSPACE}"/ || exit $?
  49. cd "$WORKSPACE" || exit $?
  50. ln -s ../examples
  51. CERT_DIR="certs/ocsp"
  52. ready_file1="$WORKSPACE"/wolf_ocsp_s2_readyF1$$
  53. ready_file2="$WORKSPACE"/wolf_ocsp_s2_readyF2$$
  54. ready_file3="$WORKSPACE"/wolf_ocsp_s2_readyF3$$
  55. ready_file4="$WORKSPACE"/wolf_ocsp_s2_readyF4$$
  56. ready_file5="$WORKSPACE"/wolf_ocsp_s2_readyF5$$
  57. printf '%s\n' "ready file 1: $ready_file1"
  58. printf '%s\n' "ready file 2: $ready_file2"
  59. printf '%s\n' "ready file 3: $ready_file3"
  60. printf '%s\n' "ready file 4: $ready_file4"
  61. printf '%s\n' "ready file 5: $ready_file5"
  62. test_cnf="ocsp_s2.cnf"
  63. wait_for_readyFile(){
  64. counter=0
  65. while [ ! -s $1 -a "$counter" -lt 20 ]; do
  66. if [[ -n "${2-}" ]]; then
  67. if ! kill -0 $2 2>&-; then
  68. echo "pid $2 for port ${3-} exited before creating ready file. bailing..."
  69. exit 1
  70. fi
  71. fi
  72. echo -e "waiting for ready file..."
  73. sleep 0.1
  74. counter=$((counter+ 1))
  75. done
  76. if test -e $1; then
  77. echo -e "found ready file, starting client..."
  78. else
  79. echo -e "NO ready file at $1 -- ending test..."
  80. exit 1
  81. fi
  82. }
  83. remove_single_rF(){
  84. if test -e $1; then
  85. printf '%s\n' "removing ready file: $1"
  86. rm $1
  87. fi
  88. }
  89. #create a configure file for cert generation with the port 0 solution
  90. create_new_cnf() {
  91. printf '%s\n' "Random Ports Selected: $1 $2 $3 $4"
  92. printf '%s\n' "#" > $test_cnf
  93. printf '%s\n' "# openssl configuration file for OCSP certificates" >> $test_cnf
  94. printf '%s\n' "#" >> $test_cnf
  95. printf '%s\n' "" >> $test_cnf
  96. printf '%s\n' "# Extensions to add to a certificate request (intermediate1-ca)" >> $test_cnf
  97. printf '%s\n' "[ v3_req1 ]" >> $test_cnf
  98. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  99. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  100. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  101. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  102. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$1" >> $test_cnf
  103. printf '%s\n' "" >> $test_cnf
  104. printf '%s\n' "# Extensions to add to a certificate request (intermediate2-ca)" >> $test_cnf
  105. printf '%s\n' "[ v3_req2 ]" >> $test_cnf
  106. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  107. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  108. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  109. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  110. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$2" >> $test_cnf
  111. printf '%s\n' "" >> $test_cnf
  112. printf '%s\n' "# Extensions to add to a certificate request (intermediate3-ca)" >> $test_cnf
  113. printf '%s\n' "[ v3_req3 ]" >> $test_cnf
  114. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  115. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  116. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  117. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  118. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$3" >> $test_cnf
  119. printf '%s\n' "" >> $test_cnf
  120. printf '%s\n' "# Extensions for a typical CA" >> $test_cnf
  121. printf '%s\n' "[ v3_ca ]" >> $test_cnf
  122. printf '%s\n' "basicConstraints = CA:true" >> $test_cnf
  123. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  124. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  125. printf '%s\n' "keyUsage = keyCertSign, cRLSign" >> $test_cnf
  126. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$4" >> $test_cnf
  127. printf '%s\n' "" >> $test_cnf
  128. printf '%s\n' "# OCSP extensions." >> $test_cnf
  129. printf '%s\n' "[ v3_ocsp ]" >> $test_cnf
  130. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  131. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  132. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  133. printf '%s\n' "extendedKeyUsage = OCSPSigning" >> $test_cnf
  134. mv $test_cnf $CERT_DIR/$test_cnf
  135. cd $CERT_DIR
  136. CURR_LOC="$PWD"
  137. printf '%s\n' "echo now in $CURR_LOC"
  138. ./renewcerts-for-test.sh $test_cnf
  139. cd $WORKSPACE
  140. }
  141. remove_ready_file(){
  142. if test -e $ready_file1; then
  143. printf '%s\n' "removing ready file: $ready_file1"
  144. rm $ready_file1
  145. fi
  146. if test -e $ready_file2; then
  147. printf '%s\n' "removing ready file: $ready_file2"
  148. rm $ready_file2
  149. fi
  150. if test -e $ready_file3; then
  151. printf '%s\n' "removing ready file: $ready_file3"
  152. rm $ready_file3
  153. fi
  154. if test -e $ready_file4; then
  155. printf '%s\n' "removing ready file: $ready_file4"
  156. rm $ready_file4
  157. fi
  158. if test -e $ready_file5; then
  159. printf '%s\n' "removing ready file: $ready_file5"
  160. rm $ready_file5
  161. fi
  162. }
  163. cleanup()
  164. {
  165. exit_status=$?
  166. for i in $(jobs -pr)
  167. do
  168. kill -s HUP "$i"
  169. done
  170. remove_ready_file
  171. rm $CERT_DIR/$test_cnf
  172. cd "$PARENTDIR" || return 1
  173. rm -r "$WORKSPACE" || return 1
  174. if [[ ("$exit_status" == 1) && ($RETRIES_REMAINING -gt 0) ]]; then
  175. echo "retrying..."
  176. RETRIES_REMAINING=$((RETRIES_REMAINING - 1))
  177. exec $0 "$@"
  178. fi
  179. }
  180. trap cleanup EXIT INT TERM HUP
  181. [ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
  182. # check if supported key size is large enough to handle 4096 bit RSA
  183. size="$(./examples/client/client '-?' | grep "Max RSA key")"
  184. size="${size//[^0-9]/}"
  185. if [ ! -z "$size" ]; then
  186. printf 'check on max key size of %d ...' $size
  187. if [ $size -lt 4096 ]; then
  188. printf '%s\n' "4096 bit RSA keys not supported"
  189. exit 0
  190. fi
  191. printf 'OK\n'
  192. fi
  193. #get four unique ports
  194. # choose consecutive ports based on the PID, skipping any that are
  195. # already bound, to avoid the birthday problem in case other
  196. # instances are sharing this host.
  197. get_first_free_port() {
  198. local ret="$1"
  199. while :; do
  200. if [[ "$ret" -ge 65536 ]]; then
  201. ret=1024
  202. fi
  203. if ! nc -z ${LOCALHOST_FOR_NC} "$ret"; then
  204. break
  205. fi
  206. ret=$((ret+1))
  207. done
  208. echo "$ret"
  209. return 0
  210. }
  211. base_port=$((((($$ + $RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
  212. port1=$(get_first_free_port $base_port)
  213. port2=$(get_first_free_port $((port1 + 1)))
  214. port3=$(get_first_free_port $((port2 + 1)))
  215. port4=$(get_first_free_port $((port3 + 1)))
  216. port5=$(get_first_free_port $((port4 + 1)))
  217. # 1:
  218. ./examples/server/server -R $ready_file1 -p $port1 &
  219. server_pid1=$!
  220. wait_for_readyFile $ready_file1 $server_pid1 $port1
  221. if [ ! -f $ready_file1 ]; then
  222. printf '%s\n' "Failed to create ready file1: \"$ready_file1\""
  223. exit 1
  224. fi
  225. # 2:
  226. ./examples/server/server -R $ready_file2 -p $port2 &
  227. server_pid2=$!
  228. wait_for_readyFile $ready_file2 $server_pid2 $port2
  229. if [ ! -f $ready_file2 ]; then
  230. printf '%s\n' "Failed to create ready file2: \"$ready_file2\""
  231. exit 1
  232. fi
  233. # 3:
  234. ./examples/server/server -R $ready_file3 -p $port3 &
  235. server_pid3=$!
  236. wait_for_readyFile $ready_file3 $server_pid3 $port3
  237. if [ ! -f $ready_file3 ]; then
  238. printf '%s\n' "Failed to create ready file3: \"$ready_file3\""
  239. exit 1
  240. fi
  241. # 4:
  242. ./examples/server/server -R $ready_file4 -p $port4 &
  243. server_pid4=$!
  244. wait_for_readyFile $ready_file4 $server_pid4 $port4
  245. if [ ! -f $ready_file4 ]; then
  246. printf '%s\n' "Failed to create ready file4: \"$ready_file4\""
  247. exit 1
  248. fi
  249. printf '%s\n' "------------- PORTS ---------------"
  250. printf '%s' "Random ports selected: $port1 $port2"
  251. printf '%s\n' " $port3 $port4"
  252. printf '%s\n' "-----------------------------------"
  253. # Use client connections to cleanly shutdown the servers
  254. ./examples/client/client -p $port1
  255. ./examples/client/client -p $port2
  256. ./examples/client/client -p $port3
  257. ./examples/client/client -p $port4
  258. create_new_cnf $port1 $port2 $port3 \
  259. $port4
  260. sleep 0.1
  261. # setup ocsp responders
  262. # OLD: ./certs/ocsp/ocspd-root-ca-and-intermediate-cas.sh &
  263. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  264. # purposes!
  265. openssl ocsp -port $port1 -nmin 1 \
  266. -index certs/ocsp/index-ca-and-intermediate-cas.txt \
  267. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  268. -rkey certs/ocsp/ocsp-responder-key.pem \
  269. -CA certs/ocsp/root-ca-cert.pem \
  270. "$@" \
  271. &
  272. # OLD: ./certs/ocsp/ocspd-intermediate2-ca-issued-certs.sh &
  273. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  274. # purposes!
  275. openssl ocsp -port $port2 -nmin 1 \
  276. -index certs/ocsp/index-intermediate2-ca-issued-certs.txt \
  277. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  278. -rkey certs/ocsp/ocsp-responder-key.pem \
  279. -CA certs/ocsp/intermediate2-ca-cert.pem \
  280. "$@" \
  281. &
  282. # OLD: ./certs/ocsp/ocspd-intermediate3-ca-issued-certs.sh &
  283. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  284. # purposes!
  285. openssl ocsp -port $port3 -nmin 1 \
  286. -index certs/ocsp/index-intermediate3-ca-issued-certs.txt \
  287. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  288. -rkey certs/ocsp/ocsp-responder-key.pem \
  289. -CA certs/ocsp/intermediate3-ca-cert.pem \
  290. "$@" \
  291. &
  292. sleep 0.1
  293. # "jobs" is not portable for posix. Must use bash interpreter!
  294. [ $(jobs -r | wc -l) -ne 3 ] && printf '\n\n%s\n' "Setup ocsp responder failed, skipping" && exit 0
  295. printf '\n\n%s\n\n' "All OCSP responders started successfully!"
  296. printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
  297. # client test against our own server - GOOD CERTS
  298. ./examples/server/server -c certs/ocsp/server3-cert.pem \
  299. -k certs/ocsp/server3-key.pem -R $ready_file5 \
  300. -p $port5 &
  301. server_pid5=$!
  302. wait_for_readyFile $ready_file5 $server_pid5 $port5
  303. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
  304. -p $port5
  305. RESULT=$?
  306. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
  307. printf '%s\n\n' "Test PASSED!"
  308. printf '%s\n\n' "TEST CASE 2 DISABLED PENDING REVIEW"
  309. #printf '%s\n\n' "------------- TEST CASE 2 SHOULD PASS ------------------------"
  310. #remove_single_rF $ready_file5
  311. #./examples/server/server -c certs/ocsp/server3-cert.pem \
  312. # -k certs/ocsp/server3-key.pem -R $ready_file5 \
  313. # -p $port5 &
  314. #wait_for_readyFile $ready_file5 $server_pid5 $port5
  315. #./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  316. # -p $port5
  317. #RESULT=$?
  318. #[ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 2 failed" && exit 1
  319. #printf '%s\n\n' "Test PASSED!"
  320. printf '%s\n\n' "------------- TEST CASE 3 SHOULD REVOKE ----------------------"
  321. # client test against our own server - REVOKED SERVER CERT
  322. remove_single_rF $ready_file5
  323. ./examples/server/server -c certs/ocsp/server4-cert.pem \
  324. -k certs/ocsp/server4-key.pem -R $ready_file5 \
  325. -p $port5 &
  326. server_pid5=$!
  327. wait_for_readyFile $ready_file5 $server_pid5 $port5
  328. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
  329. -p $port5
  330. RESULT=$?
  331. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  332. printf '%s\n\n' "Test successfully REVOKED!"
  333. printf '%s\n\n' "------------- TEST CASE 4 SHOULD REVOKE ----------------------"
  334. remove_single_rF $ready_file5
  335. ./examples/server/server -c certs/ocsp/server4-cert.pem \
  336. -k certs/ocsp/server4-key.pem -R $ready_file5 \
  337. -p $port5 &
  338. sleep 0.1
  339. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  340. -p $port5
  341. RESULT=$?
  342. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  343. printf '%s\n\n' "Test successfully REVOKED!"
  344. printf '%s\n\n' "------------- TEST CASE 5 SHOULD PASS ------------------------"
  345. # client test against our own server - REVOKED INTERMEDIATE CERT
  346. remove_single_rF $ready_file5
  347. ./examples/server/server -c certs/ocsp/server5-cert.pem \
  348. -k certs/ocsp/server5-key.pem -R $ready_file5 \
  349. -p $port5 &
  350. server_pid5=$!
  351. wait_for_readyFile $ready_file5 $server_pid5 $port5
  352. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
  353. -p $port5
  354. RESULT=$?
  355. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 3 failed $RESULT" && exit 1
  356. printf '%s\n\n' "Test PASSED!"
  357. printf '%s\n\n' "------------- TEST CASE 6 SHOULD REVOKE ----------------------"
  358. remove_single_rF $ready_file5
  359. ./examples/server/server -c certs/ocsp/server5-cert.pem \
  360. -k certs/ocsp/server5-key.pem -R $ready_file5 \
  361. -p $port5 &
  362. server_pid5=$!
  363. wait_for_readyFile $ready_file5 $server_pid5 $port5
  364. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  365. -p $port5
  366. RESULT=$?
  367. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  368. printf '%s\n\n' "Test successfully REVOKED!"
  369. printf '%s\n\n' "------------- TEST CASE 7 LOAD CERT IN SSL -------------------"
  370. remove_single_rF $ready_file5
  371. ./examples/server/server -c certs/ocsp/server1-cert.pem \
  372. -k certs/ocsp/server1-key.pem -R $ready_file5 \
  373. -p $port5 -H loadSSL &
  374. server_pid5=$!
  375. wait_for_readyFile $ready_file5 $server_pid5 $port5
  376. echo "test connection" | openssl s_client -status -legacy_renegotiation -connect ${LOCALHOST}:$port5 -cert ./certs/client-cert.pem -key ./certs/client-key.pem -CAfile ./certs/ocsp/root-ca-cert.pem
  377. RESULT=$?
  378. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection failed $RESULT" && exit 1
  379. wait $server_pid5
  380. if [ $? -ne 0 ]; then
  381. printf '%s\n' "Unexpected server result"
  382. exit 1
  383. fi
  384. printf '%s\n\n' "Test successful"
  385. printf '%s\n\n' "------------- TEST CASE 8 SHOULD REVOKE ----------------------"
  386. remove_single_rF $ready_file5
  387. ./examples/server/server -c certs/ocsp/server4-cert.pem \
  388. -k certs/ocsp/server4-key.pem -R $ready_file5 \
  389. -p $port5 -H loadSSL &
  390. server_pid5=$!
  391. sleep 0.1
  392. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  393. -p $port5
  394. RESULT=$?
  395. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  396. wait $server_pid5
  397. if [ $? -ne 1 ]; then
  398. printf '%s\n' "Unexpected server result"
  399. exit 1
  400. fi
  401. printf '%s\n\n' "Test successfully REVOKED!"
  402. # need a unique port since may run the same time as testsuite
  403. generate_port() {
  404. #-------------------------------------------------------------------------#
  405. # Generate a random port number
  406. #-------------------------------------------------------------------------#
  407. if [[ "$OSTYPE" == "linux"* ]]; then
  408. port=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))
  409. elif [[ "$OSTYPE" == "darwin"* ]]; then
  410. port=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))
  411. else
  412. echo "Unknown OS TYPE"
  413. exit 1
  414. fi
  415. }
  416. # Start OpenSSL server that has no OCSP responses to return
  417. generate_port
  418. openssl s_server -cert ./certs/server-cert.pem -key certs/server-key.pem -www -port $port &
  419. openssl_pid=$!
  420. sleep 0.1
  421. printf '%s\n\n' "------------- TEST CASE 9 SHOULD PASS ----------------------"
  422. # client asks for OCSP staple but doesn't fail when none returned
  423. ./examples/client/client -p $port -g -v 3 -W 2
  424. RESULT=$?
  425. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 9 failed" && exit 1
  426. printf '%s\n\n' "Test PASSED!"
  427. printf '%s\n\n' "------------- TEST CASE 10 SHOULD UNKNOWN -------------------"
  428. # client asks for OCSP staple but doesn't fail when none returned
  429. ./examples/client/client -p $port -g -v 3 -W 2m
  430. RESULT=$?
  431. [ $RESULT -ne 1 ] \
  432. && printf '\n\n%s\n' "Client connection 10 succeeded $RESULT" \
  433. && exit 1
  434. printf '%s\n\n' "Test PASSED!"
  435. printf '%s\n\n' "------------------- TESTS COMPLETE ---------------------------"
  436. exit 0