Commit 077d1a42 authored by Stefan Fritsch's avatar Stefan Fritsch
Browse files

Don't do OCSP checks for valid self-issued certs 

Submitted by: Kaspar Brand


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1137398 13f79535-47bb-0310-9956-ffa450edef68
parent 43a6de67

CHANGES

+2 −0
Original line number Diff line number Diff line
@@ -2,6 +2,8 @@ 


Changes with Apache 2.3.13



  *) mod_ssl: Don't do OCSP checks for valid self-issued certs. [Kaspar Brand]



  *) mod_ssl: Avoid unnecessary renegotiations with SSLVerifyDepth 0.

     PR 48215. [Kaspar Brand]

modules/ssl/ssl_engine_ocsp.c

+9 −1
Original line number Diff line number Diff line
@@ -252,6 +252,14 @@ int modssl_verify_ocsp(X509_STORE_CTX *ctx, SSLSrvConfigRec *sc, 
    apr_pool_t *vpool;

    int rv;



    /* don't do OCSP checking for valid self-issued certs */

    if (cert->valid && X509_check_issued(cert,cert) == X509_V_OK) {

        ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,

                      "Skipping OCSP check for valid self-issued cert");

        X509_STORE_CTX_set_error(ctx, X509_V_OK);

        return 1;

    }



    /* Create a temporary pool to constrain memory use (the passed-in

     * pool may be e.g. a connection pool). */

    apr_pool_create(&vpool, pool);