romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-30 01:18:07 +03:00
Code Issues Projects Releases Packages Wiki Activity

libressl: OCSP and intermediate certs workaround no longer needed

Browse source 
lib/vtls/openssl.c has a workaround for a bug with OCSP responses signed
by intermediate certs, this was fixed in LibreSSL in
912c64f68f

Bug: https://curl.haxx.se/mail/lib-2017-06/0038.html
This commit is contained in:
Stuart Henderson 2017-06-13 12:06:03 +02:00 • committed by Daniel Stenberg
parent 5d7952f52e
commit 9f54ad8f15
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/vtls/openssl.c
View file

@ -1371,7 +1371,8 @@ static CURLcode verifystatus(struct connectdata *conn,
st = SSL_CTX_get_cert_store(connssl->ctx);
#if ((OPENSSL_VERSION_NUMBER <= 0x1000201fL) /* Fixed after 1.0.2a */ || \
defined(LIBRESSL_VERSION_NUMBER))
(defined(LIBRESSL_VERSION_NUMBER) && \
LIBRESSL_VERSION_NUMBER <= 0x2040200fL))
/* The authorized responder cert in the OCSP response MUST be signed by the
peer cert's issuer (see RFC6960 section 4.2.2.2). If that's a root cert,
no problem, but if it's an intermediate cert OpenSSL has a bug where it