Hide Forgot
Description of problem: When `openssl ocsp` utility receives malformed_request, internal_error, try_later, sig_required or unauthorized it does return 0 as exit code. Version-Release number of selected component (if applicable): openssl-1.0.1e-21.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Start OCSP server that returns error messages 2. Try using ocsp tool to verify any certificate 3. Actual results: Responder Error: trylater (3) echo $? 0 Expected results: Responder Error: trylater (3) echo $? 1 Additional info: Regression from RHEL 6.5
This is actually not a regression. The non-zero exit code marks situation when the OCSP server does not reply at all or the response is not a valid OCSP response. In this case this is a valid response but a response indicating a problem. You need to parse the output of the ocsp command in the Responder Error. The 1.0.0 version actually had a bug where the valid OCSP error response was not parsed correctly and the ocsp command misidentified it as malformed response.