openssl3

[exodus1984]

Today I turned on your check on ubu 22.04 - there openssl 3 ... and when using a proxy, the check works badly.

I added simple openssl3 support in your check

 if [ -n "${HTTP_PROXY:-}" ]; then
                         OCSP_PROXY_ARGUMENT="$(echo "${HTTP_PROXY}" | sed 's/.*:\/\///' | sed 's/\/$//')"
-
+                        OPENSSL_VERSION_SHORT=${OPENSSL_VERSION%%.*}
+                                   if [ ${OPENSSL_VERSION_SHORT} -ge 3 ];then
+                                           COMMAND_OPENSSL="-proxy "${http_proxy}" -url "${OCSP_URI}""
+                                   else
+                                           COMMAND_OPENSSL="-host "${OCSP_PROXY_ARGUMENT}" -path "${OCSP_URI}""
+                                   fi
                         if [ -n "${KEYVALUE}" ]; then
-                            debuglog "executing ${OPENSSL} ocsp -timeout \"${TIMEOUT}\" -no_nonce -issuer ${ISSUER_CERT} -cert ${CERT_ELEMENT} -host \"${OCSP_PROXY_ARGUMENT}\" -path ${OCSP_URI} -header
 HOST=${OCSP_HOST}"
-                            OCSP_RESP="$(${OPENSSL} ocsp -timeout "${TIMEOUT}" -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT_ELEMENT}" -host "${OCSP_PROXY_ARGUMENT}" -path "${OCSP_URI}" -header HOST
="${OCSP_HOST}" 2>&1)"
+                            debuglog "executing ${OPENSSL} ocsp -timeout \"${TIMEOUT}\" -no_nonce -issuer ${ISSUER_CERT} -cert ${CERT_ELEMENT} ${COMMAND_OPENSSL} -header HOST=\"${OCSP_HOST}\""
+                            OCSP_RESP="$(${OPENSSL} ocsp -timeout "${TIMEOUT}" -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT_ELEMENT}" ${COMMAND_OPENSSL} -header HOST="${OCSP_HOST}" 2>&1)"
                         else
-                            debuglog "executing ${OPENSSL} ocsp -timeout \"${TIMEOUT}\" -no_nonce -issuer ${ISSUER_CERT} -cert ${CERT_ELEMENT} -host \"${OCSP_PROXY_ARGUMENT}\" -path ${OCSP_URI} -header
 HOST ${OCSP_HOST}"
-                            OCSP_RESP="$(${OPENSSL} ocsp -timeout "${TIMEOUT}" -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT_ELEMENT}" -host "${OCSP_PROXY_ARGUMENT}" -path "${OCSP_URI}" -header HOST
 "${OCSP_HOST}" 2>&1)"
+                            debuglog "executing ${OPENSSL} ocsp -timeout \"${TIMEOUT}\" -no_nonce -issuer ${ISSUER_CERT} -cert ${CERT_ELEMENT} ${COMMAND_OPENSSL} -header HOST \"${OCSP_HOST}\""
+                            OCSP_RESP="$(${OPENSSL} ocsp -timeout "${TIMEOUT}" -no_nonce -issuer "${ISSUER_CERT}" -cert "${CERT_ELEMENT}" ${COMMAND_OPENSSL} -header HOST "${OCSP_HOST}" 2>&1)"
                         fi

I tested it on 16-22.04 (LTS)

Maybe it will be useful. If not - please forgive me

[matteocorti]

Thanks! I'll try to take a look, but I don't have a running proxy infrastructure to test. The best idea would be to start a small proxy in the testing scripts to be able to test these option on all the platforms.

[matteocorti]

I am using tinyproxy for the tests and a lot of stuff has to be fixed...
Thanks for the report. I'll take a look

[matteocorti]

I just committed a first fix for the OCSP checks. But there are several other issues when using a proxy.

[matteocorti]

I fixed all the issues on my machine (macOS) and configured all the tests with and without a proxy.
If it goes well on all the platforms, I'll release a new version soon.

[matteocorti]

Should be fixed in 2.73.0 (at least it works with tinyproxy on macOS).