r509-ocsp-responder 0.3.1 → 0.3.2

data/spec/fixtures.rb

@@ -3,194 +3,149 @@ require 'pathname'
 require 'r509/io_helpers'
 
 module TestFixtures
-    extend R509::IOHelpers
-
-    FIXTURES_PATH = Pathname.new(__FILE__).dirname + "fixtures"
-
-    def self.read_fixture(filename)
-        read_data((FIXTURES_PATH + filename).to_s)
-    end
-
-    #Trustwave cert for langui.sh
-    CERT = read_fixture('cert1.pem')
-
-    #Trustwave root cert
-    STCA_CERT = read_fixture('stca.pem')
-
-
-    TEST_CA_CERT = read_fixture('test_ca.cer')
-    TEST_CA_KEY  = read_fixture('test_ca.key')
-
-    TEST_CA_OCSP_CERT = read_fixture('test_ca_ocsp.cer')
-    TEST_CA_OCSP_KEY  = read_fixture('test_ca_ocsp.key')
-
-    TEST_CA_SUBROOT_CERT = read_fixture('test_ca_subroot.cer')
-    TEST_CA_SUBROOT_KEY  = read_fixture('test_ca_subroot.key')
-
-    TEST_CA_SUBROOT_OCSP_CERT = read_fixture('test_ca_subroot_ocsp.cer')
-    TEST_CA_SUBROOT_OCSP_KEY  = read_fixture('test_ca_subroot_ocsp.key')
-
-    SECOND_CA_CERT = read_fixture('second_ca.cer')
-    SECOND_CA_KEY  = read_fixture('second_ca.key')
-
-    OCSP_TEST_CERT = read_fixture('ocsptest.r509.local.pem')
-
-    STCA_OCSP_REQUEST  = read_fixture('stca_ocsp_request.der')
-    STCA_OCSP_RESPONSE  = read_fixture('stca_ocsp_response.der')
-
-    def self.test_ca_cert
-        R509::Cert.new(:cert => TEST_CA_CERT, :key => TEST_CA_KEY)
-    end
-
-    def self.test_ca_subroot_cert
-        R509::Cert.new(:cert => TEST_CA_SUBROOT_CERT, :key => TEST_CA_SUBROOT_KEY)
-    end
-
-    def self.test_ca_server_profile
-        R509::Config::CaProfile.new(
-              :basic_constraints => "CA:FALSE",
-              :key_usage => ["digitalSignature","keyEncipherment"],
-              :extended_key_usage => ["serverAuth"],
-              :certificate_policies => [
-                    [
-                        "policyIdentifier=2.16.840.1.12345.1.2.3.4.1",
-                        "CPS.1=http://example.com/cps"
-                    ]
-                ]
-        )
-
-    end
-
-    def self.test_ca_server_profile_with_subject_item_policy
-        subject_item_policy = R509::Config::SubjectItemPolicy.new(
-            "CN" => "required",
-            "O" => "optional",
-            "ST" => "required",
-            "C" => "required",
-            "OU" => "optional"
-        )
-        R509::Config::CaProfile.new(
-            :basic_constraints => "CA:FALSE",
-            :key_usage => ["digitalSignature","keyEncipherment"],
-            :extended_key_usage => ["serverAuth"],
-            :certificate_policies => [
-                [
-                    "policyIdentifier=2.16.840.1.12345.1.2.3.4.1",
-                    "CPS.1=http://example.com/cps"
-                ]
-            ],
-            :subject_item_policy => subject_item_policy
-        )
-    end
-
-    def self.test_ca_subroot_profile
-        R509::Config::CaProfile.new(
-                  :basic_constraints => "CA:TRUE,pathlen:0",
-                  :key_usage => ["keyCertSign","cRLSign"],
-                  :extended_key_usage => [],
-                  :certificate_policies => nil)
-    end
-
-    def self.test_ca_ocspsigner_profile
-        R509::Config::CaProfile.new(
-                  :basic_constraints => "CA:FALSE",
-                  :key_usage => ["digitalSignature"],
-                  :extended_key_usage => ["OCSPSigning"],
-                  :certificate_policies => nil)
-    end
-
-    def self.second_ca_cert
-        R509::Cert.new(:cert => SECOND_CA_CERT, :key => SECOND_CA_KEY)
-    end
-
-    def self.second_ca_server_profile
-        R509::Config::CaProfile.new(
-              :basic_constraints => "CA:FALSE",
-              :key_usage => ["digitalSignature","keyEncipherment"],
-              :extended_key_usage => ["serverAuth"],
-              :certificate_policies => [
-                    [
-                        "policyIdentifier=2.16.840.1.12345.1.2.3.4.1",
-                        "CPS.1=http://example.com/cps"
-                    ]
-                ]
-        )
-
-    end
-
-    def self.second_ca_subroot_profile
-        R509::Config::CaProfile.new(
-                  :basic_constraints => "CA:TRUE,pathlen:0",
-                  :key_usage => ["keyCertSign","cRLSign"],
-                  :extended_key_usage => [],
-                  :certificate_policies => nil)
-    end
-
-
-    # @return [R509::Config::CaConfig]
-    def self.test_ca_config
-        crl_list_sio = StringIO.new
-        crl_list_sio.set_encoding("BINARY") if crl_list_sio.respond_to?(:set_encoding)
-        crl_number_sio = StringIO.new
-        crl_number_sio.set_encoding("BINARY") if crl_number_sio.respond_to?(:set_encoding)
-
-        opts = {
-          :ca_cert => test_ca_cert(),
-          :cdp_location => 'URI:http://crl.domain.com/test_ca.crl',
-          :ocsp_location => 'URI:http://ocsp.domain.com',
-          :ocsp_start_skew_seconds => 3600,
-          :ocsp_validity_hours => 48,
-          :crl_list_file => crl_list_sio,
-          :crl_number_file => crl_number_sio
-        }
-        ret = R509::Config::CaConfig.new(opts)
-
-        ret.set_profile("server", self.test_ca_server_profile)
-        ret.set_profile("subroot", self.test_ca_subroot_profile)
-        ret.set_profile("ocspsigner", self.test_ca_ocspsigner_profile)
-        ret.set_profile("server_with_subject_item_policy", self.test_ca_server_profile_with_subject_item_policy)
-
-        ret
-    end
-
-    # @return [R509::Config::CaConfig]
-    def self.test_ca_subroot_config
-        crl_list_sio = StringIO.new
-        crl_list_sio.set_encoding("BINARY") if crl_list_sio.respond_to?(:set_encoding)
-        crl_number_sio = StringIO.new
-        crl_number_sio.set_encoding("BINARY") if crl_number_sio.respond_to?(:set_encoding)
-
-        opts = {
-          :ca_cert => test_ca_subroot_cert(),
-          :cdp_location => 'URI:http://crl.domain.com/test_ca.crl',
-          :ocsp_location => 'URI:http://ocsp.domain.com',
-          :ocsp_start_skew_seconds => 3600,
-          :ocsp_validity_hours => 48,
-          :crl_list_file => crl_list_sio,
-          :crl_number_file => crl_number_sio
-        }
-        ret = R509::Config::CaConfig.new(opts)
-
-        ret.set_profile("server", self.test_ca_server_profile)
-        ret.set_profile("subroot", self.test_ca_subroot_profile)
-        ret.set_profile("ocspsigner", self.test_ca_ocspsigner_profile)
-        ret.set_profile("server_with_subject_item_policy", self.test_ca_server_profile_with_subject_item_policy)
-
-        ret
-    end
-
-    # @return [R509::Config::CaConfig] secondary config
-    def self.second_ca_config
-        opts = {
-          :ca_cert => second_ca_cert(),
-          :cdp_location => 'URI:http://crl.domain.com/test_ca.crl',
-          :ocsp_location => 'URI:http://ocsp.domain.com'
-        }
-        ret = R509::Config::CaConfig.new(opts)
-
-        ret.set_profile("server", self.second_ca_server_profile)
-        ret.set_profile("subroot", self.second_ca_subroot_profile)
-
-        ret
-    end
+  extend R509::IOHelpers
+
+  FIXTURES_PATH = Pathname.new(__FILE__).dirname + "fixtures"
+
+  def self.read_fixture(filename)
+    read_data((FIXTURES_PATH + filename).to_s)
+  end
+
+  #Trustwave cert for langui.sh
+  CERT = read_fixture('cert1.pem')
+
+  #Trustwave root cert
+  STCA_CERT = read_fixture('stca.pem')
+
+
+  TEST_CA_CERT = read_fixture('test_ca.cer')
+  TEST_CA_KEY  = read_fixture('test_ca.key')
+
+  TEST_CA_OCSP_CERT = read_fixture('test_ca_ocsp.cer')
+  TEST_CA_OCSP_KEY  = read_fixture('test_ca_ocsp.key')
+
+  TEST_CA_SUBROOT_CERT = read_fixture('test_ca_subroot.cer')
+  TEST_CA_SUBROOT_KEY  = read_fixture('test_ca_subroot.key')
+
+  TEST_CA_SUBROOT_OCSP_CERT = read_fixture('test_ca_subroot_ocsp.cer')
+  TEST_CA_SUBROOT_OCSP_KEY  = read_fixture('test_ca_subroot_ocsp.key')
+
+  SECOND_CA_CERT = read_fixture('second_ca.cer')
+  SECOND_CA_KEY  = read_fixture('second_ca.key')
+
+  OCSP_TEST_CERT = read_fixture('ocsptest.r509.local.pem')
+
+  STCA_OCSP_REQUEST  = read_fixture('stca_ocsp_request.der')
+  STCA_OCSP_RESPONSE  = read_fixture('stca_ocsp_response.der')
+
+  TEST_CA_EC_CERT = read_fixture('test_ca_ec.cer')
+  TEST_CA_EC_KEY = read_fixture('test_ca_ec.key')
+
+  def self.test_ca_cert
+    R509::Cert.new(:cert => TEST_CA_CERT, :key => TEST_CA_KEY)
+  end
+
+  def self.test_ca_ec_cert
+    R509::Cert.new(:cert => TEST_CA_EC_CERT, :key => TEST_CA_EC_KEY)
+  end
+
+  def self.test_ca_subroot_cert
+    R509::Cert.new(:cert => TEST_CA_SUBROOT_CERT, :key => TEST_CA_SUBROOT_KEY)
+  end
+
+  def self.test_ca_server_profile
+    R509::Config::CAProfile.new(
+        :basic_constraints => { "ca" => false },
+        :key_usage => ["digitalSignature","keyEncipherment"],
+        :extended_key_usage => ["serverAuth"]
+    )
+
+  end
+
+  def self.second_ca_cert
+    R509::Cert.new(:cert => SECOND_CA_CERT, :key => SECOND_CA_KEY)
+  end
+
+  def self.second_ca_server_profile
+    R509::Config::CAProfile.new(
+        :basic_constraints => { "ca" => false },
+        :key_usage => ["digitalSignature","keyEncipherment"],
+        :extended_key_usage => ["serverAuth"]
+    )
+
+  end
+
+  # @return [R509::Config::CAConfig]
+  def self.test_ca_config
+    crl_list_sio = StringIO.new
+    crl_list_sio.set_encoding("BINARY") if crl_list_sio.respond_to?(:set_encoding)
+    crl_number_sio = StringIO.new
+    crl_number_sio.set_encoding("BINARY") if crl_number_sio.respond_to?(:set_encoding)
+
+    opts = {
+      :ca_cert => test_ca_cert(),
+      :ocsp_start_skew_seconds => 3600,
+      :ocsp_validity_hours => 48,
+      :crl_list_file => crl_list_sio,
+      :crl_number_file => crl_number_sio
+    }
+    ret = R509::Config::CAConfig.new(opts)
+
+    ret.set_profile("server", self.test_ca_server_profile)
+
+    ret
+  end
+
+  # @return [R509::Config::CAConfig]
+  def self.test_ca_ec_config
+    crl_list_sio = StringIO.new
+    crl_list_sio.set_encoding("BINARY") if crl_list_sio.respond_to?(:set_encoding)
+    crl_number_sio = StringIO.new
+    crl_number_sio.set_encoding("BINARY") if crl_number_sio.respond_to?(:set_encoding)
+
+    opts = {
+      :ca_cert => test_ca_ec_cert(),
+      :ocsp_start_skew_seconds => 3600,
+      :ocsp_validity_hours => 48,
+      :crl_list_file => crl_list_sio,
+      :crl_number_file => crl_number_sio
+    }
+    ret = R509::Config::CAConfig.new(opts)
+
+    ret.set_profile("server", self.test_ca_server_profile)
+    ret
+  end
+
+  # @return [R509::Config::CAConfig]
+  def self.test_ca_subroot_config
+    crl_list_sio = StringIO.new
+    crl_list_sio.set_encoding("BINARY") if crl_list_sio.respond_to?(:set_encoding)
+    crl_number_sio = StringIO.new
+    crl_number_sio.set_encoding("BINARY") if crl_number_sio.respond_to?(:set_encoding)
+
+    opts = {
+      :ca_cert => test_ca_subroot_cert(),
+      :ocsp_start_skew_seconds => 3600,
+      :ocsp_validity_hours => 48,
+      :crl_list_file => crl_list_sio,
+      :crl_number_file => crl_number_sio
+    }
+    ret = R509::Config::CAConfig.new(opts)
+
+    ret.set_profile("server", self.test_ca_server_profile)
+
+    ret
+  end
+
+  # @return [R509::Config::CAConfig] secondary config
+  def self.second_ca_config
+    opts = {
+      :ca_cert => second_ca_cert(),
+    }
+    ret = R509::Config::CAConfig.new(opts)
+
+    ret.set_profile("server", self.second_ca_server_profile)
+
+    ret
+  end
 end

data/spec/fixtures/test_ca_ec.cer

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICJzCCAaygAwIBAgITBhgGAz3nZpKHtz6KQjnGF3l8IzAKBggqhkjOPQQDAjBb
+MQswCQYDVQQGEwJVUzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNh
+Z28xETAPBgNVBAoMCHI1MDkgTExDMRQwEgYDVQQDDAtyNTA5IEVDQyBDQTAeFw0x
+MzAxMjMxNDE1MjBaFw0zMzAxMTgyMDE1MjBaMFsxCzAJBgNVBAYTAlVTMREwDwYD
+VQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzERMA8GA1UECgwIcjUwOSBM
+TEMxFDASBgNVBAMMC3I1MDkgRUNDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE
+FoGSwxFhGtPcBRnmKSwVnYRhniE86GmTTCGyb02ch5ZENzmjdTuR4MoeBmG5RXzH
+mX1I6rcFW5sJWnmOncE0zcl7qGxash/+3wFm3qwwR1YUpDZ+TeYtezqkEegN+I2T
+ozIwMDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBS27qtirnzRTXfTrJOA46dI
+r1hc4jAKBggqhkjOPQQDAgNpADBmAjEAgy6c00RdXZ5wmRo5uFOu9aa5kUJo912+
+hiHmddmFVCyQcvsX+hq2GvFKLhwxty9jAjEA4e4WY48QArCidovB/iYXRkvE5efL
+oqXZOHh/QzwiNz66ZIGR8tv2iLoRXoG4fiWG
+-----END CERTIFICATE-----

data/spec/fixtures/test_ca_ec.key

@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDCVvOkiIED5VN04e0/zOjv2UHZ94vRt4NP939/UnPkxxoy8yQRCDW9v
+vJp4kJ2uz12gBwYFK4EEACKhZANiAAQWgZLDEWEa09wFGeYpLBWdhGGeITzoaZNM
+IbJvTZyHlkQ3OaN1O5Hgyh4GYblFfMeZfUjqtwVbmwlaeY6dwTTNyXuobFqyH/7f
+AWberDBHVhSkNn5N5i17OqQR6A34jZM=
+-----END EC PRIVATE KEY-----

data/spec/server_spec.rb

@@ -1,400 +1,408 @@
 require File.dirname(__FILE__) + '/spec_helper'
 require 'time'
-
-
-describe R509::Ocsp::Responder::Server do
-    before :all do
-        @test_ca_cert = OpenSSL::X509::Certificate.new(File.read(Pathname.new(__FILE__).dirname + "fixtures/test_ca.cer"))
-        @second_ca_cert = OpenSSL::X509::Certificate.new(File.read(Pathname.new(__FILE__).dirname + "fixtures/second_ca.cer"))
-    end
-
-    before :each do
-        # clear the dependo before each test
-        Dependo::Registry.clear
-        Dependo::Registry[:log] = Logger.new(nil)
-
-        # we always want to mock with a new redis
-        @redis = double("redis")
-        Dependo::Registry[:redis] = @redis
-
-        # and we want to mock the stats recorder
-        @stats = double("stats")
-        Dependo::Registry[:stats] = @stats
-
-        # default value for :copy_nonce is false (can override on a per-test basis)
-        Dependo::Registry[:copy_nonce] = false
-
-        # default value for :cache_headers is false (can override on a per-test basis)
-        Dependo::Registry[:cache_headers] = false
-
-        # default value for :max_cache_age is nil (can override on a per-test basis)
-        Dependo::Registry[:max_cache_age] = nil
-
-        # read the config.yaml
-        @config_pool = R509::Config::CaConfigPool.from_yaml("certificate_authorities", File.read(File.dirname(__FILE__)+"/fixtures/test_config.yaml"))
-    end
-
-    def app
-        # this is executed after the code in each test, so if we change something in the dependo registry, it'll show up here (we will set :copy_nonce in some tests)
-        Dependo::Registry[:ocsp_signer] = R509::Ocsp::Signer.new(
-            :configs => @config_pool,
-            :validity_checker => R509::Validity::Redis::Checker.new(Dependo::Registry[:redis]),
-            :copy_nonce => Dependo::Registry[:copy_nonce]
-        )
-        @app ||= R509::Ocsp::Responder::Server
-    end
-
-    it "should return unauthorized on a GET which does not match any configured CA" do
-        get '/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ1mI4Ww4R5LZiQ295pj4OF%2F44yyAQUyk7dWyc1Kdn27sPlU%2B%2BkwBmWHa8CEFqb7H4xpqYH6ed2G0%2BPMG4%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (UNKNOWN) response on a GET request from the test_ca CA" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "UNKNOWN")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_UNKNOWN
-        ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
-        ocsp_response.verify(@test_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (REVOKED) response on a GET request from the test_ca CA" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::REVOKED})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "REVOKED")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
-        ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
-        ocsp_response.verify(@test_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (VALID) response on a GET request from the test_ca CA" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
-        ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
-        ocsp_response.verify(@test_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (VALID) response on a GET request with extra leading slashes from the test_ca CA" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
-
-        get '/%2F%2FMFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
-        ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
-        ocsp_response.verify(@test_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (VALID) response on a GET request from a second configured CA (second_ca)" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
-        ocsp_response.basic.status[0][0].serial.should == 773553085290984246110251380739025914079776985795
-        ocsp_response.verify(@test_ca_cert).should == false
-        ocsp_response.verify(@second_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return unauthorized on a POST which does not match any configured CA" do
-        der = Base64.decode64(URI.decode("MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ1mI4Ww4R5LZiQ295pj4OF%2F44yyAQUyk7dWyc1Kdn27sPlU%2B%2BkwBmWHa8CEFqb7H4xpqYH6ed2G0%2BPMG4%3D"))
-        post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (UNKNOWN) response on a POST request from the test_ca CA" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "UNKNOWN")
-
-        der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
-        post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_UNKNOWN
-        ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
-        ocsp_response.verify(@test_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (REVOKED) response on a POST request from the test_ca CA" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::REVOKED})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "REVOKED")
-
-        der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
-        post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
-        ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
-        ocsp_response.verify(@test_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (VALID) response on a POST request from the test_ca CA" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
-
-        der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
-        post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
-        ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
-        ocsp_response.verify(@test_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return a valid (VALID) response on a POST request from a second configured CA (second_ca)" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
-
-        der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D"))
-        post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
-        ocsp_response.basic.status[0][0].serial.should == 773553085290984246110251380739025914079776985795
-        ocsp_response.verify(@test_ca_cert).should == false
-        ocsp_response.verify(@second_ca_cert).should == true
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "should return 200 OK when querying status and redis is available" do
-        @redis.should_receive(:ping).and_return("PONG")
-        get '/status'
-        last_response.should be_ok
-    end
-
-    it "should return 500 DOWN when querying status with redis unavailable" do
-        @redis.should_receive(:ping).and_raise(StandardError)
-        get '/status'
-        last_response.should_not be_ok
-        last_response.body.should == "Down"
-    end
-
-    it "a malformed request should return a proper OCSP response (GET)" do
-        get '/Msdfsfsdf'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_MALFORMEDREQUEST
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "a malformed request should return a proper OCSP response (POST)" do
-        post '/', 'Mdskfsdf', "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_MALFORMEDREQUEST
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.should be_ok
-    end
-
-    it "copies nonce when copy_nonce is true" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
-
-        # set to true for this test (this works because the app doesn't get set up until after this code)
-        Dependo::Registry[:copy_nonce] = true
-
-        get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
-        request = OpenSSL::OCSP::Request.new(Base64.decode64("MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF+aIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw="))
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        request.check_nonce(ocsp_response.basic).should == R509::Ocsp::Request::Nonce::PRESENT_AND_EQUAL
-
-    end
-
-    it "doesn't copy nonce when copy_nonce is false" do
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
-
-        # set to false for this test (this works because the app doesn't get set up until after this code)
-        Dependo::Registry[:copy_nonce] = false
-
-        get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
-        request = OpenSSL::OCSP::Request.new(Base64.decode64("MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF+aIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw="))
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        request.check_nonce(ocsp_response.basic).should == R509::Ocsp::Request::Nonce::REQUEST_ONLY
-    end
-
-    it "returns caching headers for GET when cache_headers is true and no nonce is present" do
-        Dependo::Registry[:cache_headers] = true
-
-        now = Time.now
-        Time.stub!(:now).and_return(now)
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.headers.size.should == 6
-        last_response.headers["Last-Modified"].should == Time.now.httpdate
-        last_response.headers["ETag"].should == OpenSSL::Digest::SHA1.new(ocsp_response.to_der).to_s
-        last_response.headers["Expires"].should == ocsp_response.basic.status[0][5].httpdate
-        max_age = ocsp_response.basic.status[0][5] - now
-        last_response.headers["Cache-Control"].should == "max-age=#{max_age.to_i}, public, no-transform, must-revalidate"
-    end
-
-    it "returns no caching headers for GET when cache_headers is false and no nonce is present" do
-        Dependo::Registry[:cache_headers] = false
-
-        now = Time.now
-        Time.stub!(:now).and_return(now)
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.headers.size.should == 2
-    end
-
-    it "returns no caching headers for GET when cache_headers is true and a nonce is present" do
-        Dependo::Registry[:cache_headers] = true
-
-        now = Time.now
-        Time.stub!(:now).and_return(now)
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
-
-        get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.headers.size.should == 2
-    end
-
-    it "returns no caching headers for GET when cache_headers is false and a nonce is present" do
-        Dependo::Registry[:cache_headers] = false
-
-        now = Time.now
-        Time.stub!(:now).and_return(now)
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
-
-        get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.headers.size.should == 2
-    end
-
-    it "returns custom max_cache_age when it's set properly" do
-        Dependo::Registry[:cache_headers] = true
-        Dependo::Registry[:max_cache_age] = 600
-
-        now = Time.now
-        Time.stub!(:now).and_return(now)
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.headers.size.should == 6
-        last_response.headers["Last-Modified"].should == now.httpdate
-        last_response.headers["ETag"].should == OpenSSL::Digest::SHA1.new(ocsp_response.to_der).to_s
-        last_response.headers["Expires"].should == ocsp_response.basic.status[0][5].httpdate
-        last_response.headers["Cache-Control"].should == "max-age=600, public, no-transform, must-revalidate"
-    end
-
-    it "returns default max_cache_age if custom age is too large" do
-        Dependo::Registry[:cache_headers] = true
-        Dependo::Registry[:max_cache_age] = 950000
-
-        now = Time.now
-        Time.stub!(:now).and_return(now)
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.headers.size.should == 6
-        last_response.headers["Last-Modified"].should == now.httpdate
-        last_response.headers["ETag"].should == OpenSSL::Digest::SHA1.new(ocsp_response.to_der).to_s
-        last_response.headers["Expires"].should == ocsp_response.basic.status[0][5].httpdate
-        max_age = ocsp_response.basic.status[0][5] - now
-        last_response.headers["Cache-Control"].should == "max-age=#{max_age.to_i}, public, no-transform, must-revalidate"
-    end
-
-    it "returns no caching headers for GET when cache_headers is false" do
-        Dependo::Registry[:cache_headers] = false
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
-
-        get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.headers.size.should == 2
-        last_response.should be_ok
-    end
-
-    it "returns no caching headers for POST when cache_headers is true" do
-        Dependo::Registry[:cache_headers] = true
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
-
-        der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
-        post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.headers.size.should == 2
-        last_response.should be_ok
-    end
-
-    it "returns no caching headers for POST when cache_headers is false" do
-        Dependo::Registry[:cache_headers] = false
-
-        @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
-        @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
-
-        der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
-        post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
-        ocsp_response = R509::Ocsp::Response.parse(last_response.body)
-        last_response.content_type.should == "application/ocsp-response"
-        last_response.headers.size.should == 2
-        last_response.should be_ok
-    end
-
-    it "should reload and print config when receiving a SIGUSR2" do
-        config = double("config")
-        stub_const("R509::Ocsp::Responder::OcspConfig",config)
-        #R509::Ocsp::Responder::OcspConfig = double("config")
-        R509::Ocsp::Responder::OcspConfig.should_receive(:load_config)
-        R509::Ocsp::Responder::OcspConfig.should_receive(:print_config)
-        Process.kill :USR2, Process.pid
-    end
+require 'r509/validity/redis'
+
+
+describe R509::OCSP::Responder::Server do
+  before :all do
+    @test_ca_cert = OpenSSL::X509::Certificate.new(File.read(Pathname.new(__FILE__).dirname + "fixtures/test_ca.cer"))
+    @second_ca_cert = OpenSSL::X509::Certificate.new(File.read(Pathname.new(__FILE__).dirname + "fixtures/second_ca.cer"))
+  end
+
+  before :each do
+    # clear the dependo before each test
+    Dependo::Registry.clear
+    Dependo::Registry[:log] = Logger.new(nil)
+
+    # we always want to mock with a new redis
+    @redis = double("redis")
+    Dependo::Registry[:validity_checker] = R509::Validity::Redis::Checker.new @redis
+
+    # and we want to mock the stats recorder
+    @stats = double("stats")
+    Dependo::Registry[:stats] = @stats
+
+    # default value for :copy_nonce is false (can override on a per-test basis)
+    Dependo::Registry[:copy_nonce] = false
+
+    # default value for :cache_headers is false (can override on a per-test basis)
+    Dependo::Registry[:cache_headers] = false
+
+    # default value for :max_cache_age is nil (can override on a per-test basis)
+    Dependo::Registry[:max_cache_age] = nil
+
+    # read the config.yaml
+    @config_pool = R509::Config::CAConfigPool.from_yaml("certificate_authorities", File.read(File.dirname(__FILE__)+"/fixtures/test_config.yaml"))
+  end
+
+  def app
+    # this is executed after the code in each test, so if we change something in the dependo registry, it'll show up here (we will set :copy_nonce in some tests)
+    Dependo::Registry[:ocsp_signer] = R509::OCSP::Signer.new(
+      :configs => @config_pool,
+      :validity_checker => Dependo::Registry[:validity_checker],
+      :copy_nonce => Dependo::Registry[:copy_nonce]
+    )
+    @app ||= R509::OCSP::Responder::Server
+  end
+
+  it "should return unauthorized on a GET which does not match any configured CA" do
+    get '/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ1mI4Ww4R5LZiQ295pj4OF%2F44yyAQUyk7dWyc1Kdn27sPlU%2B%2BkwBmWHa8CEFqb7H4xpqYH6ed2G0%2BPMG4%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (UNKNOWN) response on a GET request from the test_ca CA" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "UNKNOWN")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_UNKNOWN
+    ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
+    ocsp_response.verify(@test_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (REVOKED) response on a GET request from the test_ca CA" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::REVOKED})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "REVOKED")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
+    ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
+    ocsp_response.verify(@test_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (VALID) response on a GET request from the test_ca CA" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
+    ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
+    ocsp_response.verify(@test_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (VALID) response on a GET request with extra leading slashes from the test_ca CA" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
+
+    get '/%2F%2FMFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
+    ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
+    ocsp_response.verify(@test_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (VALID) response on a GET request from a second configured CA (second_ca)" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
+    ocsp_response.basic.status[0][0].serial.should == 773553085290984246110251380739025914079776985795
+    ocsp_response.verify(@test_ca_cert).should == false
+    ocsp_response.verify(@second_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return unauthorized on a POST which does not match any configured CA" do
+    der = Base64.decode64(URI.decode("MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ1mI4Ww4R5LZiQ295pj4OF%2F44yyAQUyk7dWyc1Kdn27sPlU%2B%2BkwBmWHa8CEFqb7H4xpqYH6ed2G0%2BPMG4%3D"))
+    post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (UNKNOWN) response on a POST request from the test_ca CA" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "UNKNOWN")
+
+    der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
+    post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_UNKNOWN
+    ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
+    ocsp_response.verify(@test_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (REVOKED) response on a POST request from the test_ca CA" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::REVOKED})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "REVOKED")
+
+    der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
+    post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
+    ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
+    ocsp_response.verify(@test_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (VALID) response on a POST request from the test_ca CA" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
+
+    der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
+    post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
+    ocsp_response.basic.status[0][0].serial.should == 1051177536915098490149656742929223623669143613238
+    ocsp_response.verify(@test_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return a valid (VALID) response on a POST request from a second configured CA (second_ca)" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
+
+    der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D"))
+    post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_response.basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
+    ocsp_response.basic.status[0][0].serial.should == 773553085290984246110251380739025914079776985795
+    ocsp_response.verify(@test_ca_cert).should == false
+    ocsp_response.verify(@second_ca_cert).should == true
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "should return 200 OK when querying status and redis is available" do
+    @redis.should_receive(:ping).and_return("PONG")
+    get '/status'
+    last_response.should be_ok
+  end
+
+  it "should return 500 DOWN when querying status with redis unavailable" do
+    @redis.should_receive(:ping).and_raise(StandardError)
+    get '/status'
+    last_response.should_not be_ok
+    last_response.body.should == "Down"
+  end
+
+  it "should return 500 DOWN when querying status with redis responding incorrectly" do
+    @redis.should_receive(:ping).and_return("")
+    get '/status'
+    last_response.should_not be_ok
+    last_response.body.should == "Down"
+  end
+
+  it "a malformed request should return a proper OCSP response (GET)" do
+    get '/Msdfsfsdf'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_MALFORMEDREQUEST
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "a malformed request should return a proper OCSP response (POST)" do
+    post '/', 'Mdskfsdf', "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    ocsp_response.status.should == OpenSSL::OCSP::RESPONSE_STATUS_MALFORMEDREQUEST
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.should be_ok
+  end
+
+  it "copies nonce when copy_nonce is true" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
+
+    # set to true for this test (this works because the app doesn't get set up until after this code)
+    Dependo::Registry[:copy_nonce] = true
+
+    get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
+    request = OpenSSL::OCSP::Request.new(Base64.decode64("MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF+aIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw="))
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    request.check_nonce(ocsp_response.basic).should == R509::OCSP::Request::Nonce::PRESENT_AND_EQUAL
+
+  end
+
+  it "doesn't copy nonce when copy_nonce is false" do
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
+
+    # set to false for this test (this works because the app doesn't get set up until after this code)
+    Dependo::Registry[:copy_nonce] = false
+
+    get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
+    request = OpenSSL::OCSP::Request.new(Base64.decode64("MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF+aIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw="))
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    request.check_nonce(ocsp_response.basic).should == R509::OCSP::Request::Nonce::REQUEST_ONLY
+  end
+
+  it "returns caching headers for GET when cache_headers is true and no nonce is present" do
+    Dependo::Registry[:cache_headers] = true
+
+    now = Time.now
+    Time.stub!(:now).and_return(now)
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.headers.size.should == 6
+    last_response.headers["Last-Modified"].should == Time.now.httpdate
+    last_response.headers["ETag"].should == OpenSSL::Digest::SHA1.new(ocsp_response.to_der).to_s
+    last_response.headers["Expires"].should == ocsp_response.basic.status[0][5].httpdate
+    max_age = ocsp_response.basic.status[0][5] - now
+    last_response.headers["Cache-Control"].should == "max-age=#{max_age.to_i}, public, no-transform, must-revalidate"
+  end
+
+  it "returns no caching headers for GET when cache_headers is false and no nonce is present" do
+    Dependo::Registry[:cache_headers] = false
+
+    now = Time.now
+    Time.stub!(:now).and_return(now)
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.headers.size.should == 2
+  end
+
+  it "returns no caching headers for GET when cache_headers is true and a nonce is present" do
+    Dependo::Registry[:cache_headers] = true
+
+    now = Time.now
+    Time.stub!(:now).and_return(now)
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
+
+    get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.headers.size.should == 2
+  end
+
+  it "returns no caching headers for GET when cache_headers is false and a nonce is present" do
+    Dependo::Registry[:cache_headers] = false
+
+    now = Time.now
+    Time.stub!(:now).and_return(now)
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:872625873161273451176241581705670534707360122361").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "872625873161273451176241581705670534707360122361", "VALID")
+
+    get '/MHsweTBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQCY2eXAtMNzVS33fF0PHrUSjklF%2BaIjMCEwHwYJKwYBBQUHMAECBBIEEDTJniOQonxCRmmHAHCVstw%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.headers.size.should == 2
+  end
+
+  it "returns custom max_cache_age when it's set properly" do
+    Dependo::Registry[:cache_headers] = true
+    Dependo::Registry[:max_cache_age] = 600
+
+    now = Time.now
+    Time.stub!(:now).and_return(now)
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.headers.size.should == 6
+    last_response.headers["Last-Modified"].should == now.httpdate
+    last_response.headers["ETag"].should == OpenSSL::Digest::SHA1.new(ocsp_response.to_der).to_s
+    last_response.headers["Expires"].should == ocsp_response.basic.status[0][5].httpdate
+    last_response.headers["Cache-Control"].should == "max-age=600, public, no-transform, must-revalidate"
+  end
+
+  it "returns default max_cache_age if custom age is too large" do
+    Dependo::Registry[:cache_headers] = true
+    Dependo::Registry[:max_cache_age] = 950000
+
+    now = Time.now
+    Time.stub!(:now).and_return(now)
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.headers.size.should == 6
+    last_response.headers["Last-Modified"].should == now.httpdate
+    last_response.headers["ETag"].should == OpenSSL::Digest::SHA1.new(ocsp_response.to_der).to_s
+    last_response.headers["Expires"].should == ocsp_response.basic.status[0][5].httpdate
+    max_age = ocsp_response.basic.status[0][5] - now
+    last_response.headers["Cache-Control"].should == "max-age=#{max_age.to_i}, public, no-transform, must-revalidate"
+  end
+
+  it "returns no caching headers for GET when cache_headers is false" do
+    Dependo::Registry[:cache_headers] = false
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA:773553085290984246110251380739025914079776985795").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=R509, Ltd/CN=R509 Secondary Test CA", "773553085290984246110251380739025914079776985795", "VALID")
+
+    get '/MFYwVDBSMFAwTjAJBgUrDgMCGgUABBT1kOLWHXbHiKP3sVPVxVziq%2FMqIwQUP8ezIf8yhMLgHnccSKJLQdhDaVkCFQCHf1HsjUAACwcp3qQL4IxclfXSww%3D%3D'
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.headers.size.should == 2
+    last_response.should be_ok
+  end
+
+  it "returns no caching headers for POST when cache_headers is true" do
+    Dependo::Registry[:cache_headers] = true
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
+
+    der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
+    post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.headers.size.should == 2
+    last_response.should be_ok
+  end
+
+  it "returns no caching headers for POST when cache_headers is false" do
+    Dependo::Registry[:cache_headers] = false
+
+    @redis.should_receive(:hgetall).with("cert:/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA:1051177536915098490149656742929223623669143613238").and_return({"status" => R509::Validity::VALID})
+    @stats.should_receive(:record).with("/C=US/ST=Illinois/L=Chicago/O=Ruby CA Project/CN=Test CA", "1051177536915098490149656742929223623669143613238", "VALID")
+
+    der = Base64.decode64(URI.decode("MFYwVDBSMFAwTjAJBgUrDgMCGgUABBQ4ykaMB0SN9IGWx21tTHBRnmCnvQQUeXW7hDrLLN56Cb4xG0O8HCpNU1gCFQC4IG5U4zC4RYb4VQ%2B2f0zCoFCvNg%3D%3D"))
+    post '/', der, "CONTENT_TYPE" => "application/ocsp-request"
+    ocsp_response = R509::OCSP::Response.parse(last_response.body)
+    last_response.content_type.should == "application/ocsp-response"
+    last_response.headers.size.should == 2
+    last_response.should be_ok
+  end
+
+  it "should reload and print config when receiving a SIGUSR2" do
+    config = double("config")
+    stub_const("R509::OCSP::Responder::OCSPConfig",config)
+    #R509::OCSP::Responder::OCSPConfig = double("config")
+    R509::OCSP::Responder::OCSPConfig.should_receive(:load_config)
+    R509::OCSP::Responder::OCSPConfig.should_receive(:print_config)
+    Process.kill :USR2, Process.pid
+  end
 end