Commit bbe9c3d5 authored by Johannes Bauer's avatar Johannes Bauer Committed by Rich Salz
Browse files

Clarify CLI OCSP documentation 



This fixes issue #3043, which ultimately was reported because
documentation was not clear on the meaning of the "-ignore_err" option.
Update both command line documentation and add this option to manpage.

Reviewed-by: default avatarAndy Polyakov <appro@openssl.org>
Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4143)
parent 44e69951

apps/ocsp.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -108,7 +108,7 @@ const OPTIONS ocsp_options[] = { 
    {"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"},

    {"host", OPT_HOST, 's', "TCP/IP hostname:port to connect to"},

    {"port", OPT_PORT, 'p', "Port to run responder on"},

    {"port", OPT_PORT, 'p', "Port to run responder on"},

    {"ignore_err", OPT_IGNORE_ERR, '-',

    {"ignore_err", OPT_IGNORE_ERR, '-',

     "Ignore Error response from OCSP responder, and retry "},

     "Ignore error on OCSP request or response and continue running"},

    {"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},

    {"noverify", OPT_NOVERIFY, '-', "Don't verify response at all"},

    {"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},

    {"nonce", OPT_NONCE, '-', "Add OCSP nonce to request"},

    {"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},

    {"no_nonce", OPT_NO_NONCE, '-', "Don't add OCSP nonce to request"},

doc/man1/ocsp.pod

+7 −0
Original line number Original line Diff line number Diff line
@@ -74,6 +74,7 @@ B<openssl> B<ocsp> 
[B<-no_cert_checks>]

[B<-no_cert_checks>]

[B<-no_explicit>]

[B<-no_explicit>]

[B<-port num>]

[B<-port num>]

[B<-ignore_err>]

[B<-index file>]

[B<-index file>]

[B<-CA file>]

[B<-CA file>]

[B<-rsigner file>]

[B<-rsigner file>]
@@ -343,6 +344,12 @@ specified in the B<rsigner> option is used. 
Port to listen for OCSP requests on. The port may also be specified

Port to listen for OCSP requests on. The port may also be specified

using the B<url> option.

using the B<url> option.





=item B<-ignore_err>



Ignore malformed requests or responses: When acting as an OCSP client, retry if

a malformed response is received. When acting as an OCSP responder, continue

running instead of terminating upon receiving a malformed request.



=item B<-nrequest number>

=item B<-nrequest number>





The OCSP server will exit after receiving B<number> requests, default unlimited.

The OCSP server will exit after receiving B<number> requests, default unlimited.