···
100
+
# Test OCSP Stapling
101
+
specialisation.ocsp-stapling.configuration = { pkgs, ... }: {
102
+
security.acme.certs."a.example.test" = {
103
+
ocspMustStaple = true;
105
+
services.nginx.virtualHosts."a.example.com" = {
108
+
ssl_stapling_verify on;
# Test using Apache HTTPD
specialisation.httpd-aliases.configuration = { pkgs, config, lib, ... }: {
services.nginx.enable = lib.mkForce false;
···
testScript = {nodes, ...}:
179
+
caDomain = nodes.acme.config.test-support.acme.caDomain;
newServerSystem = nodes.webserver.config.system.build.toplevel;
switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
···
return check_connection_key_bits(node, domain, bits, retries - 1)
263
+
def check_stapling(node, domain, retries=3):
264
+
assert retries >= 0
266
+
# Pebble doesn't provide a full OCSP responder, so just check the URL
267
+
result = node.succeed(
268
+
"openssl s_client -CAfile /tmp/ca.crt"
269
+
f" -servername {domain} -connect {domain}:443 < /dev/null"
270
+
" | openssl x509 -noout -ocsp_uri"
272
+
print("OCSP Responder URL:", result)
274
+
if "${caDomain}:4002" not in result.lower():
276
+
return check_stapling(node, domain, retries - 1)
···
client.wait_for_unit("default.target")
256
-
'curl --data \'{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
286
+
'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
···
acme.wait_for_unit("default.target")
acme.wait_for_unit("pebble.service")
265
-
client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt")
266
-
client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt")
295
+
client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
296
+
client.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")
with subtest("Can request certificate with HTTPS-01 challenge"):
webserver.wait_for_unit("acme-finished-a.example.test.target")
···
webserver.wait_for_unit("acme-finished-a.example.test.target")
check_connection_key_bits(client, "a.example.test", "384")
webserver.succeed("grep testing /var/lib/acme/a.example.test/test")
323
+
with subtest("Correctly implements OCSP stapling"):
324
+
switch_to(webserver, "ocsp-stapling")
325
+
webserver.wait_for_unit("acme-finished-a.example.test.target")
326
+
check_stapling(client, "a.example.test")
with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"):
switch_to(webserver, "slow-startup")
pyrox.dev