Golang, sending OCSP request returns

The standard allows for requests to made via GET or POST. See the code below for an example that works with the POST method. This example works in my company's corporate PKI and almost works with the NIST PIV test cards (https://csrc.nist.gov/projects/piv/nist-personal-identity-verification-test-cards), but trips over a bug in Go that may have been resolved in 1.11 (see https://github.com/golang/go/issues/21527)

Note that some OCSP responders require the host header. Also, both of the OSCP responders in my environment want SHA1 for the hash algorithm and fail when SHA256 is used.

func isCertificateRevokedByOCSP(commonName string, clientCert, issuerCert *x509.Certificate, ocspServer string) bool {
    opts := &ocsp.RequestOptions{Hash: crypto.SHA1}
    buffer, err := ocsp.CreateRequest(clientCert, issuerCert, opts)
    if err != nil {
        return false
    }
    httpRequest, err := http.NewRequest(http.MethodPost, ocspServer, bytes.NewBuffer(buffer))
    if err != nil {
        return false
    }
    ocspUrl, err := url.Parse(ocspServer)
    if err != nil {
        return false
    }
    httpRequest.Header.Add("Content-Type", "application/ocsp-request")
    httpRequest.Header.Add("Accept", "application/ocsp-response")
    httpRequest.Header.Add("host", ocspUrl.Host)
    httpClient := &http.Client{}
    httpResponse, err := httpClient.Do(httpRequest)
    if err != nil {
        return false
    }
    defer httpResponse.Body.Close()
    output, err := ioutil.ReadAll(httpResponse.Body)
    if err != nil {
        return false
    }
    ocspResponse, err := ocsp.ParseResponse(output, issuerCert)
    if err != nil {
        return false
    }
    if ocspResponse.Status == ocsp.Revoked {
        logger.GetLogger().Warnf("certificate '%s' has been revoked by OCSP server %s, refusing connection", commonName, ocspServer)
        return true
    } else {
        return false
    }
}

Came across this while looking for a Go example of an OCSP request. Here's the function I ended up with for anyone looking for a complete example:

// CheckOCSPStatus will make an OCSP request for the provided certificate.
// If the status of the certificate is not good, then an error is returned.
func CheckOCSPStatus(ctx context.Context, cert *x509.Certificate) error {
    var (
        ocspURL       = cert.OCSPServer[0]
        issuerCertURL = cert.IssuingCertificateURL[0]
    )

    // download the issuer certificate
    issuer, err := getCert(ctx, issuerCertURL)
    if err != nil {
        return fmt.Errorf("getting issuer certificate: %w", err)
    }

    // Build OCSP request
    buffer, err := ocsp.CreateRequest(cert, issuer, &ocsp.RequestOptions{
        Hash: crypto.SHA1,
    })
    if err != nil {
        return fmt.Errorf("creating ocsp request body: %w", err)
    }

    req, err := http.NewRequest(http.MethodPost, ocspURL, bytes.NewBuffer(buffer))
    if err != nil {
        return fmt.Errorf("creating http request: %w", err)
    }

    ocspUrl, err := url.Parse(ocspURL)
    if err != nil {
        return fmt.Errorf("parsing ocsp url: %w", err)
    }

    req.Header.Add("Content-Type", "application/ocsp-request")
    req.Header.Add("Accept", "application/ocsp-response")
    req.Header.Add("host", ocspUrl.Host)
    req = req.WithContext(ctx)

    // Make OCSP request
    httpResponse, err := http.DefaultClient.Do(req)
    if err != nil {
        return fmt.Errorf("making ocsp request: %w", err)
    }

    defer httpResponse.Body.Close()

    output, err := ioutil.ReadAll(httpResponse.Body)
    if err != nil {
        return fmt.Errorf("reading response body: %w", err)
    }

    // Parse response
    ocspResponse, err := ocsp.ParseResponse(output, issuer)
    if err != nil {
        return fmt.Errorf("parsing ocsp response: %w", err)
    }

    // check status
    if ocspResponse.Status != ocsp.Good {
        return fmt.Errorf("invalid cert status: %v", ocspResponse.Status)
    }

    return nil
}

func getCert(ctx context.Context, url string) (*x509.Certificate, error) {
    req, _ := http.NewRequest(http.MethodGet, url, nil)
    req = req.WithContext(ctx)

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        return nil, fmt.Errorf("getting cert from %s: %w", url, err)
    }

    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        return nil, fmt.Errorf("reading response body: %w", err)
    }

    cert, err := x509.ParseCertificate(body)
    if err != nil {
        return nil, fmt.Errorf("parsing certificate: %w", err)
    }

    return cert, nil
}

Here's a complete and runnable gist: https://gist.github.com/alexrudd/ca792642c1f7923ee344b3645a420006