Bug #97622 for IO-Socket-SSL: Failed test 'expected revoked, but SSL connect attempt failed

Wed Jul 30 09:48:33 2014 DAVEWOOD [...] cpan.org - Ticket created

Subject:

Failed test 'expected revoked, but SSL connect attempt failed

debian wheezy perlbrew perl 5.20.0 PERL_DL_NONLAZY=1 /home/david/perl5/perlbrew/perls/perl-5.20.0/bin/perl "-MExtUtils::Command::MM" "-MTest::Harness" "-e" "undef *Test::Harness::Switches; test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/external/*.t # openssl version=0x1000105f # Net::SSLeay::VERSION=1.65 t/01loadmodule.t .................. ok t/acceptSSL-timeout.t ............. ok t/auto_verify_hostname.t .......... ok t/cert_formats.t .................. ok t/cert_no_file.t .................. ok t/compatibility.t ................. ok t/connectSSL-timeout.t ............ ok t/core.t .......................... ok t/dhe.t ........................... ok t/ecdhe.t ......................... ok # tcp connect to www.live.com:443 ok # tcp connect to www.google.com:443 ok # tcp connect to revoked.grc.com:443 ok # fingerprint matches # validation with default CA w/o OCSP ok # Failed test 'expected revoked, but SSL connect attempt failed error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error' # at t/external/ocsp.t line 108. # Looks like you failed 1 test of 3. t/external/ocsp.t ................. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/3 subtests (less 2 skipped subtests: 0 okay) see more details in the attached cpanm build log

Subject:

build.log

Download build.log
application/octet-stream 6.5k

Message body not shown because it is not plain text.

Wed Jul 30 12:30:17 2014 dwheeler [...] cpan.org - Correspondence added

I'm seeing exactly the same error on CentOS 6.5.

Wed Jul 30 12:30:18 2014 The RT System itself - Status changed from 'new' to 'open'

Wed Jul 30 12:30:40 2014 dwheeler [...] cpan.org - Cc DWHEELER added

Sat Aug 02 15:45:02 2014 Steffen_Ullrich [...] genua.de - Correspondence added

Show quoted text

> error:27069065:OCSP routines:OCSP_basic_verify:certificate verify > error error:27069065:OCSP routines:OCSP_basic_verify:certificate

This is very strange, because it gets a OCSP response which it cannot verify instead of the expected 'certificate revoked' response. Does this problem happen every time you run this test?

Mon Aug 04 05:29:50 2014 DAVEWOOD [...] cpan.org - Correspondence added

On Sat Aug 02 15:45:02 2014, SULLR wrote: Show quoted text

> > error:27069065:OCSP routines:OCSP_basic_verify:certificate verify > > error error:27069065:OCSP routines:OCSP_basic_verify:certificate

> > This is very strange, because it gets a OCSP response which it cannot > verify instead of the expected 'certificate revoked' response. > Does this problem happen every time you run this test?

I just downloaded version 1.997 changed into the directory and ran `prove -lvr t` and all tests passed. when I wrote the bug report IO::Socket::SSL wasnt installed and the error came from running `cpanm IO::Socket::SSL` but I force installed it afterwards, so not exactly the same circumstances.

Mon Aug 04 11:59:52 2014 dwheeler [...] cpan.org - Correspondence added

All tests pass for me now, too. Could a server have been down?

Sat Aug 16 16:20:02 2014 Steffen_Ullrich [...] genua.de - Correspondence added

Am Mo 04. Aug 2014, 11:59:52, DWHEELER schrieb: Show quoted text

> All tests pass for me now, too. Could a server have been down?

Not down, but serving an invalid (maybe expired) OCSP response. It looks like a temporary problem so I close this bug.

Sat Aug 16 16:20:03 2014 Steffen_Ullrich [...] genua.de - Status changed from 'open' to 'resolved'