Method test_sign_good_cert

tests/x509/test_ocsp.py:630–678

(self)

            builder.sign(private_key, "notahash")  # type: ignore[arg-type]

    def test_sign_good_cert(self):
        builder = ocsp.OCSPResponseBuilder()
        cert, issuer = _cert_and_issuer()
        root_cert, private_key = _generate_root()
        current_time = (
            datetime.datetime.now(datetime.timezone.utc)
            .replace(tzinfo=None)
            .replace(microsecond=0)
        )
        this_update = current_time - datetime.timedelta(days=1)
        next_update = this_update + datetime.timedelta(days=7)
        builder = builder.responder_id(
            ocsp.OCSPResponderEncoding.NAME, root_cert
        ).add_response(
            cert,
            issuer,
            hashes.SHA1(),
            ocsp.OCSPCertStatus.GOOD,
            this_update,
            next_update,
            None,
            None,
        )
        resp = builder.sign(private_key, hashes.SHA256())
        assert resp.responder_name == root_cert.subject
        assert resp.responder_key_hash is None
        with pytest.warns(utils.DeprecatedIn43):
            assert (current_time - resp.produced_at).total_seconds() < 10
        assert (
            current_time.replace(tzinfo=datetime.timezone.utc)
            - resp.produced_at_utc
        ).total_seconds() < 10
        assert (
            resp.signature_algorithm_oid
            == x509.SignatureAlgorithmOID.ECDSA_WITH_SHA256
        )
        assert resp.certificate_status == ocsp.OCSPCertStatus.GOOD
        assert resp.revocation_reason is None

        _check_ocsp_response_times(
            resp,
            this_update=this_update,
            next_update=next_update,
            revocation_time=None,
        )

        private_key.public_key().verify(
            resp.signature, resp.tbs_response_bytes, ec.ECDSA(hashes.SHA256())
        )

    def test_sign_revoked_cert(self):
        builder = ocsp.OCSPResponseBuilder()