Without setting the server's identities to "www.example.com" and "crl.example.com", it will just return 400 (bad request) to any requests made to these hosts, and it will not run the registered prefix handler that causes the test to fail. Fixing this also uncovered an issue in the case where the EE cert doesn't have an OCSP url; it turns out libpkix will make an OCSP request for the intermediate before getting to the EE.

Comment on attachment 8361298 [details] [diff] [review] 960723-failingOCSPResponder.diff Review of attachment 8361298 [details] [diff] [review]: ----------------------------------------------------------------- I guess you could say... (•_•) ( •_•)>⌐■-■ (⌐■_■) I don't know how to write code that fails.

My only response is this: http://mirrors.rit.edu/instantCSI/ (requires flash, unfortunately. Maybe I'll make an html5 one...) Thanks for the quick review. https://hg.mozilla.org/integration/mozilla-inbound/rev/a2d581209387