--cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)

curl built with OpenSSL accepts a stapled OCSP "good" response of any age under CURLOPT_SSL_VERIFYSTATUS (--cert-status) when the response omits nextUpdate, so a response signed before a certificate was revoked keeps passing the check for as long as the certificate itself is valid. The GnuTLS …

#!/usr/bin/env python3
# curl --cert-status with OpenSSL: a fresh "revoked" staple is rejected, an old "good" one for the same cert without nextUpdate is accepted
# needs: python3 cryptography, openssl s_server on PATH; usage: python3 poc_ocsp_age.py /path/to/curl
import datetime, subprocess, sys, …