Commit f68e2921 authored by Kaspar Brand's avatar Kaspar Brand
Browse files

Better safe than sorry: with OpenSSL 1.0, X509_STORE_CTX_get_current_cert() 

may not always return a cert.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162553 13f79535-47bb-0310-9956-ffa450edef68
parent 8752bf47

modules/ssl/ssl_engine_ocsp.c

+8 −1
Changes for modules/ssl/ssl_engine_ocsp.c: 8 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -252,8 +252,15 @@ int modssl_verify_ocsp(X509_STORE_CTX *ctx, SSLSrvConfigRec *sc, 
    apr_pool_t *vpool;

    int rv;



    if (!cert) {

        /* starting with OpenSSL 1.0, X509_STORE_CTX_get_current_cert()

         * may yield NULL. Return early, but leave the ctx error as is. */

        ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,

                      "No cert available to check with OCSP");

        return 1;

    }

    else if (cert->valid && X509_check_issued(cert,cert) == X509_V_OK) {

        /* don't do OCSP checking for valid self-issued certs */

    if (cert->valid && X509_check_issued(cert,cert) == X509_V_OK) {

        ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,

                      "Skipping OCSP check for valid self-issued cert");

        X509_STORE_CTX_set_error(ctx, X509_V_OK);