Changeset a3e0f7b in mod_gnutls for src/mod_gnutls.c

Timestamp:

Jan 12, 2020, 10:01:55 AM (9 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master, proxy-ticket

Children:

5c9ca6b

Parents:

845c112

git-author:

Fiona Klute <fiona.klute@…> (01/12/20 07:50:52)

git-committer:

Fiona Klute <fiona.klute@…> (01/12/20 10:01:55)

Message:

Support a list of files for the GnuTLSOCSPResponseFile option

This allows users to specify multiple responses for multi-staple. Note
that mod_gnutls will try to send its own requests for certificates
without a matching response.

File:

• src/mod_gnutls.c (modified) (2 diffs)

src/mod_gnutls.c

@@ -3 +3 @@
  *  Copyright 2008, 2014 Nikos Mavrogiannopoulos
  *  Copyright 2011 Dash Shendy
- *  Copyright 2015-2019 Fiona Klute
+ *  Copyright 2015-2020 Fiona Klute
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
@@ -379 +379 @@
                  NULL, RSRC_CONF,
                  "Check nonce in OCSP responses?"),
-    AP_INIT_TAKE1("GnuTLSOCSPResponseFile", mgs_store_ocsp_response_path,
+    AP_INIT_TAKE_ARGV("GnuTLSOCSPResponseFile", mgs_store_ocsp_response_path,
                   NULL, RSRC_CONF,
-                  "Read OCSP response for stapling from this file instead "
-                  "of sending a request over HTTP (must be updated "
-                  "externally)"),
+                  "Read OCSP responses for stapling from these files instead "
+                  "of sending a request over HTTP. Files must be listed in "
+                  "the same order as listed in GnuTLSX509CertificateFile, "
+                  "and must be updated externally. Use the empty string "
+                  "(\"\") to skip a certificate in the list."),
     AP_INIT_TAKE1("GnuTLSOCSPCacheTimeout", mgs_set_timeout,
                   NULL, RSRC_CONF,