[jmestwa-coder]

load_der_ocsp_response rejects a successful response with no responseBytes, but not the reverse:

• a tryLater, unauthorized or other non-successful status that still carries a BasicOCSPResponse loads fine
• every BasicResponse property then returns the embedded data instead of raising ValueError as documented, e.g. resp-sha256.der with the status flipped to tryLater reports TRY_LATER and certificate_status GOOD
• RFC 6960 4.2.1 only allows responseBytes with a successful status, and responseStatus sits outside the signed data

Now raises ValueError at load time, with a regression test and a changelog entry.

[alex]

This is not the right way to do this -- we want a checked in vector with teh right bytes, not a mutation of an existing vector.

[jmestwa-coder]

Makes sense. Added x509/ocsp/resp-unsuccessful-response-bytes.der (resp-sha256.der with the status set to tryLater), documented it in test-vectors.rst, and the test now just loads it.