Add OCSP round trip integration test with minor fixes

[samuel40791765]

Description of changes:

Now that we have support for OCSP responder functions, we can now do a round trip integration test with an OCSP request from an OCSP client <-> OCSP response from an OCSP responder. There were a couple bugs found along the way and this implements fixes along with the new tests.

1. OCSP_cert_to_id allows for a NULL subject, then passes a NULL serialNumber to OCSP_cert_id_new. OpenSSL allows the NULL parameter, but we disallow it. Changed to allow NULL for better interoptability.
2. Our implementation of X509_gmtime_adj happens to use UTC Time, but the producedAt field for OCSP OCSP_RESPDATA expects generalized time. This causes a parsing failure from OCSP responses we generated. This was pinned down to X509_gmtime_adj calling ASN1_TIME_adj internally, which allocates UTCTime if it fits.

• aws-lc/include/openssl/asn1.h

  Lines 1417 to 1426 in 353228b

  	// ASN1_TIME_adj adds |offset_day| days and |offset_sec| seconds to
  	// |posix_time| and writes the result to |s|. As in RFC 5280, section 4.1.2.5,
  	// it uses UTCTime when the time fits and GeneralizedTime otherwise. It returns
  	// |s| on success and NULL on error. If |s| is NULL, it returns a
  	// newly-allocated |ASN1_GENERALIZEDTIME| instead.
  	//
  	// Note this function may fail if the time overflows or is out of range for
  	// GeneralizedTime.
  	OPENSSL_EXPORT ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, int64_t posix_time,
  	int offset_day, long offset_sec);

Call-outs:

N/A

Testing:

New round trip tests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 86.48649% with 15 lines in your changes missing coverage. Please review.

Project coverage is 78.38%. Comparing base (97a04f5) to head (af35ef1).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
crypto/ocsp/ocsp_integration_test.cc	92.55%	4 Missing and 3 partials ⚠️
crypto/test/test_util.cc	46.15%	3 Missing and 4 partials ⚠️
crypto/ocsp/ocsp_lib.c	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1811      +/-   ##
==========================================
+ Coverage   78.37%   78.38%   +0.01%     
==========================================
  Files         582      582              
  Lines       97416    97507      +91     
  Branches    13966    13982      +16     
==========================================
+ Hits        76346    76429      +83     
- Misses      20450    20453       +3     
- Partials      620      625       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[WillChilds-Klein]

i'm not super familiar with the requirements here. is serialNumber expected to be populated at this point in execution?

[samuel40791765]

In this case, it was because OCSP_cert_to_id allows for a NULL subject, then passes the NULL serialNumber to OCSP_cert_id_new. OpenSSL allows the NULL parameter and just simply skips populating it.
This was intended for self-signed certificates in OCSP_cert_to_id extracts where the subject name is extracted from the issuer and a serial number is given NULL.