r509-ocsp-responder 0.3.1 → 0.3.2

data/spec/signer_spec.rb

@@ -2,274 +2,287 @@ require 'spec_helper'
 require 'r509/ocsp'
 require 'openssl'
 
-describe R509::Ocsp::Signer do
-    before :all do
-        @cert = TestFixtures::CERT
-        @stca_cert = TestFixtures::STCA_CERT
-        @stca_ocsp_request = TestFixtures::STCA_OCSP_REQUEST
-        @ocsp_test_cert = TestFixtures::OCSP_TEST_CERT
-        @test_ca_config = TestFixtures.test_ca_config
-        @test_ca_subroot_config = TestFixtures.test_ca_subroot_config
-        @second_ca_config = TestFixtures.second_ca_config
-        @ocsp_delegate_config = R509::Config::CaConfig.from_yaml("ocsp_delegate_ca", File.read("#{File.dirname(__FILE__)}/fixtures/config_test_various.yaml"), {:ca_root_path => "#{File.dirname(__FILE__)}/fixtures"})
-        @ocsp_subroot_delegate_config = R509::Config::CaConfig.from_yaml("ocsp_subroot_delegate_ca", File.read("#{File.dirname(__FILE__)}/fixtures/config_test_various.yaml"), {:ca_root_path => "#{File.dirname(__FILE__)}/fixtures"})
-        @ocsp_chain_config = R509::Config::CaConfig.from_yaml("ocsp_chain_ca", File.read("#{File.dirname(__FILE__)}/fixtures/config_test_various.yaml"), {:ca_root_path => "#{File.dirname(__FILE__)}/fixtures"})
-        Dependo::Registry.clear
-        Dependo::Registry[:log] = Logger.new(nil)
+describe R509::OCSP::Signer do
+  before :all do
+    @cert = TestFixtures::CERT
+    @stca_cert = TestFixtures::STCA_CERT
+    @stca_ocsp_request = TestFixtures::STCA_OCSP_REQUEST
+    @ocsp_test_cert = TestFixtures::OCSP_TEST_CERT
+    @test_ca_config = TestFixtures.test_ca_config
+    @test_ca_ec_config = TestFixtures.test_ca_ec_config
+    @test_ca_subroot_config = TestFixtures.test_ca_subroot_config
+    @second_ca_config = TestFixtures.second_ca_config
+    @ocsp_delegate_config = R509::Config::CAConfig.from_yaml("ocsp_delegate_ca", File.read("#{File.dirname(__FILE__)}/fixtures/config_test_various.yaml"), {:ca_root_path => "#{File.dirname(__FILE__)}/fixtures"})
+    @ocsp_subroot_delegate_config = R509::Config::CAConfig.from_yaml("ocsp_subroot_delegate_ca", File.read("#{File.dirname(__FILE__)}/fixtures/config_test_various.yaml"), {:ca_root_path => "#{File.dirname(__FILE__)}/fixtures"})
+    @ocsp_chain_config = R509::Config::CAConfig.from_yaml("ocsp_chain_ca", File.read("#{File.dirname(__FILE__)}/fixtures/config_test_various.yaml"), {:ca_root_path => "#{File.dirname(__FILE__)}/fixtures"})
+    Dependo::Registry.clear
+    Dependo::Registry[:log] = Logger.new(nil)
 
-    end
-    it "allows access to the validity checker object" do
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        ocsp_handler.validity_checker.kind_of?(R509::Validity::DefaultChecker).should == true
-    end
+  end
+  it "allows access to the validity checker object" do
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    ocsp_handler.validity_checker.kind_of?(R509::Validity::DefaultChecker).should == true
+  end
 
-    it "rejects ocsp requests from an unknown CA" do
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(@stca_ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
-    end
-    it "rejects malformed OCSP requests" do
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request("notreallyanocsprequest")
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_MALFORMEDREQUEST
-    end
-    it "responds successfully with an OCSP delegate" do
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @ocsp_delegate_config) )
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        request_response[:response].verify(@ocsp_delegate_config.ca_cert.cert).should == true
-        #TODO Better way to check whether we're adding the certs when signing the basic_response than response size...
-        request_response[:response].to_der.size.should >= 1500
-        request_response[:response].to_der.size.should <= 1800
-    end
-    it "responds successfully for a subroot (signing via subroot)" do
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_subroot_config) )
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_subroot_config)
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_subroot_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        request_response[:response].verify([@test_ca_subroot_config.ca_cert.cert,@test_ca_config.ca_cert.cert]).should == true
-    end
-    it "responds successfully for a subroot (signing via delegate)" do
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @ocsp_subroot_delegate_config) )
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_subroot_config)
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_subroot_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        request_response[:response].verify([@test_ca_subroot_config.ca_cert.cert,@test_ca_config.ca_cert.cert]).should == true
-    end
-    it "responds successfully with an OCSP chain" do
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @ocsp_chain_config) )
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        request_response[:response].verify(@ocsp_chain_config.ca_cert.cert).should == true
-        #TODO Better way to check whether we're adding the certs when signing the basic_response than response size...
-        request_response[:response].to_der.size.should >= 3600
-        request_response[:response].to_der.size.should <= 3900
-    end
-    it "responds successfully from the test_ca" do
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
-        request_response[:request].should_not be_nil
-    end
-    it "rejects request with 2 certs from different known CAs" do
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
+  it "rejects ocsp requests from an unknown CA" do
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(@stca_ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
+  end
+  it "rejects malformed OCSP requests" do
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request("notreallyanocsprequest")
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_MALFORMEDREQUEST
+  end
+  it "responds successfully with an OCSP delegate" do
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @ocsp_delegate_config) )
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    request_response[:response].verify(@ocsp_delegate_config.ca_cert.cert).should == true
+    #TODO Better way to check whether we're adding the certs when signing the basic_response than response size...
+    request_response[:response].to_der.size.should >= 1500
+    request_response[:response].to_der.size.should <= 1800
+  end
+  it "responds successfully for a subroot (signing via subroot)" do
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_subroot_config) )
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_subroot_config)
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_subroot_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    request_response[:response].verify([@test_ca_subroot_config.ca_cert.cert,@test_ca_config.ca_cert.cert]).should == true
+  end
+  it "responds successfully for a subroot (signing via delegate)" do
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @ocsp_subroot_delegate_config) )
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_subroot_config)
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_subroot_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    request_response[:response].verify([@test_ca_subroot_config.ca_cert.cert,@test_ca_config.ca_cert.cert]).should == true
+  end
+  it "responds successfully with an OCSP chain" do
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @ocsp_chain_config) )
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    request_response[:response].verify(@ocsp_chain_config.ca_cert.cert).should == true
+    #TODO Better way to check whether we're adding the certs when signing the basic_response than response size...
+    request_response[:response].to_der.size.should >= 3600
+    request_response[:response].to_der.size.should <= 3900
+  end
+  it "responds successfully from the test_ca" do
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    request_response[:request].should_not be_nil
+  end
+  it "responds successfully from an elliptic curve CA" do
+    csr = R509::CSR.new( :subject => [['CN','ocspectest.r509.local']], :type => :ec )
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_ec_config)
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_ec_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca_ec' => @test_ca_ec_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    request_response[:request].should_not be_nil
+  end
+  it "rejects request with 2 certs from different known CAs" do
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
 
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
 
-        ca2 = R509::CertificateAuthority::Signer.new(@second_ca_config)
+    ca2 = R509::CertificateAuthority::Signer.new(@second_ca_config)
 
-        csr2 = R509::Csr.new( :subject => [['CN','ocsptest2.r509.local']], :bit_strength => 1024 )
-        cert2 = ca2.sign(:csr => csr2, :profile_name => 'server')
+    csr2 = R509::CSR.new( :subject => [['CN','ocsptest2.r509.local']], :bit_strength => 1024 )
+    cert2 = ca2.sign(:csr => csr2, :profile_name => 'server')
 
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        certid2 = OpenSSL::OCSP::CertificateId.new(cert2.cert,@second_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid2)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    certid2 = OpenSSL::OCSP::CertificateId.new(cert2.cert,@second_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid2)
 
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config, 'second_ca' => @second_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
-        request_response[:request].should be_nil
-    end
-    it "rejects request with 1 cert from known CA and 1 cert from unknown CA" do
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config, 'second_ca' => @second_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
+    request_response[:request].should be_nil
+  end
+  it "rejects request with 1 cert from known CA and 1 cert from unknown CA" do
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
 
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
 
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        certid2 = OpenSSL::OCSP::CertificateId.new(OpenSSL::X509::Certificate.new(@cert),OpenSSL::X509::Certificate.new(@stca_cert))
-        ocsp_request.add_certid(certid2)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    certid2 = OpenSSL::OCSP::CertificateId.new(OpenSSL::X509::Certificate.new(@cert),OpenSSL::X509::Certificate.new(@stca_cert))
+    ocsp_request.add_certid(certid2)
 
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
-    end
-    it "responds successfully with 2 certs from 1 known CA" do
-        ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_UNAUTHORIZED
+  end
+  it "responds successfully with 2 certs from 1 known CA" do
+    ca = R509::CertificateAuthority::Signer.new(@test_ca_config)
 
-        csr = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        cert = ca.sign(:csr => csr, :profile_name => 'server')
+    csr = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    cert = ca.sign(:csr => csr, :profile_name => 'server')
 
-        csr2 = R509::Csr.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
-        cert2 = ca.sign(:csr => csr2, :profile_name => 'server')
+    csr2 = R509::CSR.new( :subject => [['CN','ocsptest.r509.local']], :bit_strength => 1024 )
+    cert2 = ca.sign(:csr => csr2, :profile_name => 'server')
 
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        certid2 = OpenSSL::OCSP::CertificateId.new(cert2.cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid2)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert.cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    certid2 = OpenSSL::OCSP::CertificateId.new(cert2.cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid2)
 
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].status.should == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
+  end
+  it "signs an OCSP response properly" do
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].verify(@test_ca_config.ca_cert.cert).should == true
+    request_response[:response].verify(@second_ca_config.ca_cert.cert).should == false
+    request_response[:response].basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
+  end
+  it "passes in a specific validity checker" do
+    class R509::Validity::BogusTestChecker < R509::Validity::Checker
+      def check(issuer_fingerprint, serial)
+        R509::Validity::Status.new(:status => R509::Validity::REVOKED, :revocation_time => Time.now.to_i)
+      end
     end
-    it "signs an OCSP response properly" do
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].verify(@test_ca_config.ca_cert.cert).should == true
-        request_response[:response].verify(@second_ca_config.ca_cert.cert).should == false
-        request_response[:response].basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_GOOD
-    end
-    it "passes in a specific validity checker" do
-        class R509::Validity::BogusTestChecker < R509::Validity::Checker
-            def check(issuer_fingerprint, serial)
-                R509::Validity::Status.new(:status => R509::Validity::REVOKED, :revocation_time => Time.now.to_i)
-            end
-        end
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_handler = R509::Ocsp::Signer.new({ :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config), :validity_checker => R509::Validity::BogusTestChecker.new })
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].verify(@test_ca_config.ca_cert.cert).should == true
-        request_response[:response].basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
-    end
-    it "encodes the proper revocation time in the response" do
-        time = Time.now.to_i-3600
-        class R509::Validity::BogusTestChecker < R509::Validity::Checker
-            def initialize(time)
-                @time = time
-            end
-            def check(issuer_fingerprint, serial)
-                R509::Validity::Status.new(:status => R509::Validity::REVOKED, :revocation_time => @time)
-            end
-        end
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_handler = R509::Ocsp::Signer.new({ :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config), :validity_checker => R509::Validity::BogusTestChecker.new(time) })
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].basic.status[0][3].to_i.should == time
-    end
-    it "copies nonce from request to response if copy_nonce is true" do
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_request.add_nonce
-        ocsp_handler = R509::Ocsp::Signer.new({ :copy_nonce => true, :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) })
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].check_nonce(ocsp_request).should == R509::Ocsp::Request::Nonce::PRESENT_AND_EQUAL
-    end
-    it "doesn't copy nonce if request doesn't have one and copy_nonce is true" do
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_handler = R509::Ocsp::Signer.new( :copy_nonce => true, :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].check_nonce(ocsp_request).should == R509::Ocsp::Request::Nonce::BOTH_ABSENT
-    end
-    it "doesn't copy nonce if request doesn't have one and copy_nonce is false" do
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_handler = R509::Ocsp::Signer.new( :copy_nonce => false, :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].check_nonce(ocsp_request).should == R509::Ocsp::Request::Nonce::BOTH_ABSENT
-    end
-    it "nonce in request only if copy_nonce is false" do
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        ocsp_request.add_nonce
-        ocsp_handler = R509::Ocsp::Signer.new( :copy_nonce => false, :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].check_nonce(ocsp_request).should == R509::Ocsp::Request::Nonce::REQUEST_ONLY
-    end
-    it "encodes thisUpdate/nextUpdate time properly" do
-        cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
-        ocsp_request = OpenSSL::OCSP::Request.new
-        certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
-        ocsp_request.add_certid(certid)
-        now = Time.now
-        ocsp_handler = R509::Ocsp::Signer.new( :configs => R509::Config::CaConfigPool.new('testca' => @test_ca_config) )
-        request_response = ocsp_handler.handle_request(ocsp_request)
-        request_response[:response].basic.status[0][4].to_i.should == now.to_i - @test_ca_config.ocsp_start_skew_seconds
-        request_response[:response].basic.status[0][5].to_i.should == now.to_i + @test_ca_config.ocsp_validity_hours*3600
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_handler = R509::OCSP::Signer.new({ :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config), :validity_checker => R509::Validity::BogusTestChecker.new })
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].verify(@test_ca_config.ca_cert.cert).should == true
+    request_response[:response].basic.status[0][1].should == OpenSSL::OCSP::V_CERTSTATUS_REVOKED
+  end
+  it "encodes the proper revocation time in the response" do
+    time = Time.now.to_i-3600
+    class R509::Validity::BogusTestChecker < R509::Validity::Checker
+      def initialize(time)
+        @time = time
+      end
+      def check(issuer_fingerprint, serial)
+        R509::Validity::Status.new(:status => R509::Validity::REVOKED, :revocation_time => @time)
+      end
     end
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_handler = R509::OCSP::Signer.new({ :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config), :validity_checker => R509::Validity::BogusTestChecker.new(time) })
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].basic.status[0][3].to_i.should == time
+  end
+  it "copies nonce from request to response if copy_nonce is true" do
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_request.add_nonce
+    ocsp_handler = R509::OCSP::Signer.new({ :copy_nonce => true, :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) })
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].check_nonce(ocsp_request).should == R509::OCSP::Request::Nonce::PRESENT_AND_EQUAL
+  end
+  it "doesn't copy nonce if request doesn't have one and copy_nonce is true" do
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_handler = R509::OCSP::Signer.new( :copy_nonce => true, :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].check_nonce(ocsp_request).should == R509::OCSP::Request::Nonce::BOTH_ABSENT
+  end
+  it "doesn't copy nonce if request doesn't have one and copy_nonce is false" do
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_handler = R509::OCSP::Signer.new( :copy_nonce => false, :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].check_nonce(ocsp_request).should == R509::OCSP::Request::Nonce::BOTH_ABSENT
+  end
+  it "nonce in request only if copy_nonce is false" do
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    ocsp_request.add_nonce
+    ocsp_handler = R509::OCSP::Signer.new( :copy_nonce => false, :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].check_nonce(ocsp_request).should == R509::OCSP::Request::Nonce::REQUEST_ONLY
+  end
+  it "encodes thisUpdate/nextUpdate time properly" do
+    cert = OpenSSL::X509::Certificate.new(@ocsp_test_cert)
+    ocsp_request = OpenSSL::OCSP::Request.new
+    certid = OpenSSL::OCSP::CertificateId.new(cert,@test_ca_config.ca_cert.cert)
+    ocsp_request.add_certid(certid)
+    now = Time.now
+    ocsp_handler = R509::OCSP::Signer.new( :configs => R509::Config::CAConfigPool.new('testca' => @test_ca_config) )
+    request_response = ocsp_handler.handle_request(ocsp_request)
+    request_response[:response].basic.status[0][4].to_i.should == now.to_i - @test_ca_config.ocsp_start_skew_seconds
+    request_response[:response].basic.status[0][5].to_i.should == now.to_i + @test_ca_config.ocsp_validity_hours*3600
+  end
 end
 
-describe R509::Ocsp::Helper::RequestChecker do
-    before :all do
-        @cert = TestFixtures::CERT
-        @test_ca_config = TestFixtures.test_ca_config
-        @second_ca_config = TestFixtures.second_ca_config
-    end
-    it "fails if initialized without R509::Config::CaConfigPool" do
-        expect { R509::Ocsp::Helper::RequestChecker.new({}, nil) }.to raise_error(R509::R509Error,'Must pass R509::Config::CaConfigPool object')
-    end
-    it "fails if you give it a valid config but nil validity checker" do
-        expect { R509::Ocsp::Helper::RequestChecker.new(R509::Config::CaConfigPool.new('testca' =>@test_ca_config), nil) }.to raise_error(R509::R509Error,'Must supply a R509::Validity::Checker')
-    end
-    it "fails if you give it a valid config but the validity checker doesn't respond to a check method" do
-        class FakeChecker
-        end
-        fake_checker = FakeChecker.new
-        expect { R509::Ocsp::Helper::RequestChecker.new([@test_ca_config], fake_checker) }.to raise_error(R509::R509Error)
+describe R509::OCSP::Helper::RequestChecker do
+  before :all do
+    @cert = TestFixtures::CERT
+    @test_ca_config = TestFixtures.test_ca_config
+    @second_ca_config = TestFixtures.second_ca_config
+  end
+  it "fails if initialized without R509::Config::CAConfigPool" do
+    expect { R509::OCSP::Helper::RequestChecker.new({}, nil) }.to raise_error(R509::R509Error,'Must pass R509::Config::CAConfigPool object')
+  end
+  it "fails if you give it a valid config but nil validity checker" do
+    expect { R509::OCSP::Helper::RequestChecker.new(R509::Config::CAConfigPool.new('testca' =>@test_ca_config), nil) }.to raise_error(R509::R509Error,'Must supply a R509::Validity::Checker')
+  end
+  it "fails if you give it a valid config but the validity checker doesn't respond to a check method" do
+    class FakeChecker
     end
+    fake_checker = FakeChecker.new
+    expect { R509::OCSP::Helper::RequestChecker.new([@test_ca_config], fake_checker) }.to raise_error(R509::R509Error)
+  end
 end
 
-describe R509::Ocsp::Helper::ResponseSigner do
+describe R509::OCSP::Helper::ResponseSigner do
 end