ocspresponder_basic_certificate_status_validation_wsgi_server.py

1from ocspresponder import OCSPResponder
2from cryptography import x509
3from cryptography.hazmat.primitives import serialization, hashes
4
5# Load the responder's certificate and private key
6with open('responder.crt', 'rb') as f:
7    responder_cert = x509.load_pem_x509_certificate(f.read())
8
9with open('responder.key', 'rb') as f:
10    responder_key = serialization.load_pem_private_key(f.read(), password=None)
11
12# Load the issuer certificate
13with open('issuer.crt', 'rb') as f:
14    issuer_cert = x509.load_pem_x509_certificate(f.read())
15
16def validate_certificate(serial: int) -> x509.ocsp.OCSPCertStatus:
17    """
18    This function is called by the responder to check the status of a certificate.
19    Return OCSPCertStatus.GOOD, OCSPCertStatus.REVOKED, or OCSPCertStatus.UNKNOWN.
20    """
21    if serial == 12345:
22        return x509.ocsp.OCSPCertStatus.GOOD
23    return x509.ocsp.OCSPCertStatus.REVOKED
24
25# Initialize the responder
26app = OCSPResponder(
27    issuer_cert=issuer_cert,
28    responder_cert=responder_cert,
29    responder_key=responder_key,
30    validate_func=validate_certificate
31)
32
33if __name__ == '__main__':
34    # The app is a standard WSGI application
35    from wsgiref.simple_server import make_server
36    httpd = make_server('', 8080, app)
37    print("Serving on port 8080...")
38    httpd.serve_forever()