OCSP observability: variables $tls_{in,out}_ocsp

and smtp transport option hosts_request_ocsp

12 files changed, 147 insertions, 47 deletions

diff --git a/test/confs/5600 b/test/confs/5600
index 8b26ee7fa..cd5f3c8e7 100644
--- a/test/confs/5600
+++ b/test/confs/5600
@@ -14,6 +14,8 @@ gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
+acl_smtp_connect = check_connect
+acl_smtp_mail = check_mail
 acl_smtp_rcpt = check_recipient
 
 log_selector = +tls_peerdn
@@ -37,6 +39,12 @@ tls_ocsp_file = OCSP
 
 begin acl
 
+check_connect:
+  accept   logwrite = acl_conn: ocsp in status: $tls_in_ocsp
+
+check_mail:
+  accept   logwrite = acl_mail: ocsp in status: $tls_in_ocsp
+
 check_recipient:
   deny     message = certificate not verified: peerdn=$tls_peerdn
          ! verify = certificate
diff --git a/test/confs/5601 b/test/confs/5601
index 5172ff279..7eb19f754 100644
--- a/test/confs/5601
+++ b/test/confs/5601
@@ -18,6 +18,8 @@ gecos_name = CALLER_NAME
 domainlist local_domains = test.ex : *.test.ex
 
 acl_smtp_rcpt = check_recipient
+acl_smtp_data = check_data
+
 log_selector = +tls_peerdn
 remote_max_parallel = 1
 
@@ -47,6 +49,10 @@ check_recipient:
   accept  domains = +local_domains
   deny    message = relay not permitted
 
+check_data:
+  warn	  condition   = ${if def:h_X-TLS-out:}
+	  logwrite = client claims: $h_X-TLS-out:
+  accept
 
 # ----- Routers -----
 
@@ -57,8 +63,9 @@ client:
   condition = ${if eq {SERVER}{server}{no}{yes}}
   retry_use_local_part
   transport = send_to_server${if eq{$local_part}{nostaple}{1} \
-				{${if eq{$local_part}{smtps} {3}{2}}} \
-			     }
+				{${if eq{$local_part}{norequire} {2} \
+				{${if eq{$local_part}{smtps} {4}{3}}} \
+			     }}}
 
 server:
   driver = redirect
@@ -84,30 +91,41 @@ send_to_server1:
   port = PORT_D
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
   hosts_require_tls = *
-# note no ocsp here
+  hosts_request_ocsp = :
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp
 
 send_to_server2:
   driver = smtp
   allow_localhost
+  hosts = HOSTIPV4
+  port = PORT_D
+  tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  hosts_require_tls = *
+# note no ocsp mention here
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp
+
+send_to_server3:
+  driver = smtp
+  allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
   helo_data = helo.data.changed
-  #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
   hosts_require_tls =  *
   hosts_require_ocsp = *
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp
 
-send_to_server3:
+send_to_server4:
   driver = smtp
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
   helo_data = helo.data.changed
-  #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
   protocol =           smtps
   hosts_require_tls =  *
   hosts_require_ocsp = *
+  headers_add = X-TLS-out: ocsp status $tls_out_ocsp
 
 
 # ----- Retry -----
diff --git a/test/confs/5650 b/test/confs/5650
index 12584c731..3d4a68ef3 100644
--- a/test/confs/5650
+++ b/test/confs/5650
@@ -14,6 +14,8 @@ gecos_name = CALLER_NAME
 
 # ----- Main settings -----
 
+acl_smtp_connect = check_connect
+acl_smtp_mail = check_mail
 acl_smtp_rcpt = check_recipient
 
 log_selector = +tls_peerdn
@@ -38,6 +40,12 @@ tls_ocsp_file = OCSP
 
 begin acl
 
+check_connect:
+  accept   logwrite = acl_conn: ocsp in status: $tls_in_ocsp
+
+check_mail:
+  accept   logwrite = acl_mail: ocsp in status: $tls_in_ocsp
+
 check_recipient:
   accept
 
diff --git a/test/confs/5651 b/test/confs/5651
index e38043f3e..4a1989f43 100644
--- a/test/confs/5651
+++ b/test/confs/5651
@@ -18,6 +18,8 @@ gecos_name = CALLER_NAME
 domainlist local_domains = test.ex : *.test.ex
 
 acl_smtp_rcpt = check_recipient
+acl_smtp_data = check_data
+
 log_selector = +tls_peerdn
 remote_max_parallel = 1
 
@@ -44,6 +46,11 @@ check_recipient:
   accept  domains = +local_domains
   deny    message = relay not permitted
 
+check_data:
+  warn	  condition   = ${if def:h_X-TLS-out:}
+	  logwrite = client claims: $h_X-TLS-out:
+  accept
+
 
 # ----- Routers -----
 
@@ -54,8 +61,9 @@ client:
   condition = ${if eq {SERVER}{server}{no}{yes}}
   retry_use_local_part
   transport = send_to_server${if eq{$local_part}{nostaple}{1} \
-				{${if eq{$local_part}{smtps} {3}{2}}} \
-			     }
+				{${if eq{$local_part}{norequire} {2} \
+				{${if eq{$local_part}{smtps} {4}{3}}} \
+			     }}}
 
 server:
   driver = redirect
@@ -81,11 +89,22 @@ send_to_server1:
   port = PORT_D
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
   hosts_require_tls = *
-# note no ocsp here
+  hosts_request_ocsp = :
+  headers_add = X-TLS-out: OCSP status $tls_out_ocsp
 
 send_to_server2:
   driver = smtp
   allow_localhost
+  hosts = HOSTIPV4
+  port = PORT_D
+  tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  hosts_require_tls = *
+# note no ocsp mention here
+  headers_add = X-TLS-out: OCSP status $tls_out_ocsp
+
+send_to_server3:
+  driver = smtp
+  allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
   helo_data = helo.data.changed
@@ -93,8 +112,9 @@ send_to_server2:
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
   hosts_require_tls =  *
   hosts_require_ocsp = *
+  headers_add = X-TLS-out: OCSP status $tls_out_ocsp
 
-send_to_server3:
+send_to_server4:
   driver = smtp
   allow_localhost
   hosts = 127.0.0.1
@@ -105,6 +125,7 @@ send_to_server3:
   protocol =           smtps
   hosts_require_tls =  *
   hosts_require_ocsp = *
+  headers_add = X-TLS-out: OCSP status $tls_out_ocsp
 
 
 # ----- Retry -----
diff --git a/test/log/5600 b/test/log/5600
index 869883f06..d0dc7b16e 100644
--- a/test/log/5600
+++ b/test/log/5600
@@ -1,6 +1,10 @@
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0
 1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] Recieved OCSP stapling req; responding
+1999-03-02 09:44:33 acl_mail: ocsp in status: 3
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0
 1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] Recieved OCSP stapling req; not responding
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0
 1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] Recieved OCSP stapling req; not responding
diff --git a/test/log/5601 b/test/log/5601
index 40caa0f88..d3c46eda0 100644
--- a/test/log/5601
+++ b/test/log/5601
@@ -1,32 +1,42 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 => nostaple@test.ex R=client T=send_to_server1 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/CN=server1.example.com" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => norequire@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/CN=server1.example.com" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER@test.ex R=client T=send_to_server2 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => nostaple@test.ex R=client T=send_to_server1 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/CN=server1.example.com" C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbB-0005vi-00 Received TLS status response, null content
-1999-03-02 09:44:33 10HmbB-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmbB-0005vi-00 == CALLER@test.ex R=client T=send_to_server2 defer (-37): failure while setting up TLS session
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbC-0005vi-00 Server certificate revoked; reason: superseded
-1999-03-02 09:44:33 10HmbC-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmbC-0005vi-00 == CALLER@test.ex R=client T=send_to_server2 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbA-0005vi-00 => CALLER@test.ex R=client T=send_to_server3 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/CN=server1.example.com" C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbD-0005vi-00 Server OSCP dates invalid
+1999-03-02 09:44:33 10HmbD-0005vi-00 Received TLS status callback, null content
 1999-03-02 09:44:33 10HmbD-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmbD-0005vi-00 == CALLER@test.ex R=client T=send_to_server2 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbD-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbE-0005vi-00 Server certificate revoked; reason: superseded
+1999-03-02 09:44:33 10HmbE-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (SSL_connect): error: <<detail omitted>>
+1999-03-02 09:44:33 10HmbE-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbF-0005vi-00 Server OSCP dates invalid
+1999-03-02 09:44:33 10HmbF-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (SSL_connect): error: <<detail omitted>>
+1999-03-02 09:44:33 10HmbF-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37): failure while setting up TLS session
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 [ip4.ip4.ip4.ip4] Recieved OCSP stapling req; not responding
+1999-03-02 09:44:33 10HmaY-0005vi-00 client claims: ocsp status 1
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@server1.example.com H=the.local.host.name (server1.example.com) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 S=sss id=E10HmaX-0005vi-00@server1.example.com
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <nostaple@test.ex> R=server
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <norequire@test.ex> R=server
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmbB-0005vi-00 client claims: ocsp status 0
 1999-03-02 09:44:33 [127.0.0.1] Recieved OCSP stapling req; responding
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@server1.example.com H=(helo.data.changed) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 S=sss id=E10HmaZ-0005vi-00@server1.example.com
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <CALLER@test.ex> R=server
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@server1.example.com H=the.local.host.name (server1.example.com) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 S=sss id=E10HmaZ-0005vi-00@server1.example.com
+1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <nostaple@test.ex> R=server
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 client claims: ocsp status 3
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@server1.example.com H=(helo.data.changed) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 S=sss id=E10HmbA-0005vi-00@server1.example.com
+1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@test.ex> R=server
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 [127.0.0.1] Recieved OCSP stapling req; not responding
 1999-03-02 09:44:33 TLS error on connection from (helo.data.changed) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
diff --git a/test/log/5650 b/test/log/5650
index 072756d4e..139d3e7b5 100644
--- a/test/log/5650
+++ b/test/log/5650
@@ -1,7 +1,11 @@
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0
+1999-03-02 09:44:33 acl_mail: ocsp in status: 2
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (recv): The TLS connection was non-properly terminated.
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (send): The specified session has been invalidated for some reason.
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 acl_conn: ocsp in status: 0
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (recv): The TLS connection was non-properly terminated.
 1999-03-02 09:44:33 TLS error on connection from [ip4.ip4.ip4.ip4] (send): The specified session has been invalidated for some reason.
diff --git a/test/log/5651 b/test/log/5651
index a42426a7e..194443aa8 100644
--- a/test/log/5651
+++ b/test/log/5651
@@ -1,28 +1,37 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 => nostaple@test.ex R=client T=send_to_server1 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 DN="CN=server1.example.com" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => norequire@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 DN="CN=server1.example.com" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => CALLER@test.ex R=client T=send_to_server2 H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 DN="CN=server1.example.com" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => nostaple@test.ex R=client T=send_to_server1 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 DN="CN=server1.example.com" C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbB-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (certificate status check failed)
-1999-03-02 09:44:33 10HmbB-0005vi-00 == CALLER@test.ex R=client T=send_to_server2 defer (-37): failure while setting up TLS session
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbC-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (certificate verification failed): certificate revoked
-1999-03-02 09:44:33 10HmbC-0005vi-00 == CALLER@test.ex R=client T=send_to_server2 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbA-0005vi-00 => CALLER@test.ex R=client T=send_to_server3 H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 DN="CN=server1.example.com" C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmbD-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (certificate status check failed)
-1999-03-02 09:44:33 10HmbD-0005vi-00 == CALLER@test.ex R=client T=send_to_server2 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbD-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbE-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (certificate verification failed): certificate revoked
+1999-03-02 09:44:33 10HmbE-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@server1.example.com U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmbF-0005vi-00 TLS error on connection to 127.0.0.1 [127.0.0.1] (certificate status check failed)
+1999-03-02 09:44:33 10HmbF-0005vi-00 == CALLER@test.ex R=client T=send_to_server3 defer (-37): failure while setting up TLS session
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaY-0005vi-00 client claims: OCSP status 1
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@server1.example.com H=the.local.host.name (server1.example.com) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 S=sss id=E10HmaX-0005vi-00@server1.example.com
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <nostaple@test.ex> R=server
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <norequire@test.ex> R=server
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@server1.example.com H=(helo.data.changed) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 S=sss id=E10HmaZ-0005vi-00@server1.example.com
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <CALLER@test.ex> R=server
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 client claims: OCSP status 0
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@server1.example.com H=the.local.host.name (server1.example.com) [ip4.ip4.ip4.ip4] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 S=sss id=E10HmaZ-0005vi-00@server1.example.com
+1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <nostaple@test.ex> R=server
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 client claims: OCSP status 3
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@server1.example.com H=(helo.data.changed) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 S=sss id=E10HmbA-0005vi-00@server1.example.com
+1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <CALLER@test.ex> R=server
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 TLS error on connection from [127.0.0.1] (recv): The TLS connection was non-properly terminated.
 1999-03-02 09:44:33 TLS error on connection from [127.0.0.1] (send): The specified session has been invalidated for some reason.
diff --git a/test/scripts/5600-OCSP-OpenSSL/5601 b/test/scripts/5600-OCSP-OpenSSL/5601
index b2983eb0d..cf0f68fc7 100644
--- a/test/scripts/5600-OCSP-OpenSSL/5601
+++ b/test/scripts/5600-OCSP-OpenSSL/5601
@@ -1,10 +1,10 @@
 # OCSP stapling, client
 #
 #
-# Client works when we don't demand OCSP stapling
+# Client works when we request but don't require OCSP stapling and none comes
 exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null
 ****
-exim nostaple@test.ex
+exim norequire@test.ex
 test message.
 ****
 sleep 1
@@ -13,10 +13,18 @@ killdaemon
 #
 #
 #
-# Client accepts good stapled info
+# Client works when we don't request OCSP stapling
 exim -bd -oX PORT_D -DSERVER=server \
  -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
+exim nostaple@test.ex
+test message.
+****
+#
+#
+#
+#
+# Client accepts good stapled info
 exim CALLER@test.ex
 test message.
 ****
@@ -25,7 +33,7 @@ killdaemon
 #
 #
 #
-# Client fails on lack of requested stapled info
+# Client fails on lack of required stapled info
 exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null
 ****
 exim CALLER@test.ex
diff --git a/test/scripts/5650-OCSP-GnuTLS/5651 b/test/scripts/5650-OCSP-GnuTLS/5651
index f5432be19..5ed784be2 100644
--- a/test/scripts/5650-OCSP-GnuTLS/5651
+++ b/test/scripts/5650-OCSP-GnuTLS/5651
@@ -1,10 +1,10 @@
 # OCSP stapling, client
 #
 #
-# Client works when we don't demand OCSP stapling
+# Client works when we request but don't require OCSP stapling and none comes
 exim -bd -oX PORT_D -DSERVER=server -DOCSP=""
 ****
-exim nostaple@test.ex
+exim norequire@test.ex
 test message.
 ****
 sleep 1
@@ -13,10 +13,18 @@ killdaemon
 #
 #
 #
-# Client accepts good stapled info
+# Client works when we don't request OCSP stapling
 exim -bd -oX PORT_D -DSERVER=server \
  -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp
 ****
+exim nostaple@test.ex
+test message.
+****
+#
+#
+#
+#
+# Client accepts good stapled info
 exim CALLER@test.ex
 test message.
 ****
@@ -25,7 +33,7 @@ killdaemon
 #
 #
 #
-# Client fails on lack of requested stapled info
+# Client fails on lack of required stapled info
 exim -bd -oX PORT_D -DSERVER=server -DOCSP=""
 ****
 exim CALLER@test.ex
diff --git a/test/stderr/5410 b/test/stderr/5410
index b84c26492..ddd6dbcc6 100644
--- a/test/stderr/5410
+++ b/test/stderr/5410
@@ -81,6 +81,7 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
 127.0.0.1 in hosts_require_ocsp? no (option unset)
+127.0.0.1 in hosts_request_ocsp? yes (matched "*")
   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
diff --git a/test/stderr/5420 b/test/stderr/5420
index d2fb575b5..9eea77d05 100644
--- a/test/stderr/5420
+++ b/test/stderr/5420
@@ -81,6 +81,7 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
 127.0.0.1 in hosts_require_ocsp? no (option unset)
+127.0.0.1 in hosts_request_ocsp? yes (matched "*")
  in tls_verify_hosts? no (option unset)
  in tls_try_verify_hosts? no (option unset)
   SMTP>> EHLO myhost.test.ex