Function VerifyOCSPEndpoint

command/certificate/verify.go:380–414

(endpoint string, cert, issuer *x509.Certificate, httpClient *http.Client)

}

func VerifyOCSPEndpoint(endpoint string, cert, issuer *x509.Certificate, httpClient *http.Client) (bool, error) {
	req, err := ocsp.CreateRequest(cert, issuer, nil)
	if err != nil {
		return false, errors.Errorf("error creating OCSP request")
	}

	httpReq, err := http.NewRequest(http.MethodPost, endpoint, bytes.NewReader(req))
	if err != nil {
		return false, errors.Errorf("error contacting OCSP server: %s", endpoint)
	}
	httpReq.Header.Add("Content-Type", "application/ocsp-request")
	httpResp, err := httpClient.Do(httpReq) // #nosec G704 -- request relies on values from certificate or intentionally provided by user
	if err != nil {
		return false, errors.Errorf("error contacting OCSP server: %s", endpoint)
	}
	defer httpResp.Body.Close()
	respBytes, err := io.ReadAll(httpResp.Body)
	if err != nil {
		return false, errors.Errorf("error reading response from OCSP server: %s", endpoint)
	}

	resp, err := ocsp.ParseResponse(respBytes, issuer)
	if err != nil {
		return false, errors.Errorf("error parsing response from OCSP server: %s", endpoint)
	}

	switch resp.Status {
	case ocsp.Revoked:
		return true, errors.Errorf("certificate has been revoked according to OCSP %s", endpoint)
	case ocsp.Good:
		return true, nil
	default:
		return true, errors.Errorf("certificate status is unknown according to OCSP %s", endpoint)
	}
}

func VerifyCRLEndpoint(endpoint string, cert, issuer *x509.Certificate, httpClient *http.Client, insecure bool) (bool, error) {
	resp, err := httpClient.Get(endpoint)