From dafb49f878aff0651056c217e9af8d1329bf6310 Mon Sep 17 00:00:00 2001
From: Ugochukwu Mmaduekwe <ugo4brain@gmail.com>
Date: Thu, 10 Sep 2026 17:56:48 +0100
Subject: [PATCH] Rebuild the OCSP test chain each run instead of caching it

TOcspTest cached its generated certificate chain and reference instant in
instance fields behind a nil guard, and SetUp never cleared them. DUnit reuses
a test-case instance for the life of the process, so a second run reused the
first run's chain: its CRLs pin thisUpdate/nextUpdate to the original instant
(a ten-minute window) while the path is validated against the live clock, so
once the runs were more than a few minutes apart the cached CRLs were stale and
the "clean CRLs accept the path" cases flipped to rejection, with the blame
index shifting to the intermediate once the cached certificates also expired.

Clear the cached chain fields in SetUp so EnsureChain rebuilds a fresh,
time-consistent chain on every run.
---
 CryptoLib.Tests/src/Ocsp/OcspTests.pas | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CryptoLib.Tests/src/Ocsp/OcspTests.pas b/CryptoLib.Tests/src/Ocsp/OcspTests.pas
index 6d5dc43e..81af7b4a 100644
--- a/CryptoLib.Tests/src/Ocsp/OcspTests.pas
+++ b/CryptoLib.Tests/src/Ocsp/OcspTests.pas
@@ -170,6 +170,13 @@ procedure TOcspTest.SetUp;
   FRandom := TSecureRandom.Create();
   FKeyPair := TCertTestUtilities.GenerateRsaKeyPair(1024);
   FSignerCert := TCertTestUtilities.GenerateRootCert(FKeyPair);
+  FRootCert := nil;
+  FInterCert := nil;
+  FEndCert := nil;
+  FRootKeyPair := nil;
+  FInterKeyPair := nil;
+  FEndKeyPair := nil;
+  FChainUtcNow := 0;
 end;
 
 function TOcspTest.SignerChain: TCryptoLibGenericArray<IX509Certificate>;