Changeset b888e8b in mod_gnutls for include/mod_gnutls.h.in

Timestamp:

Nov 1, 2016, 7:20:42 AM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

b26a792

Parents:

b34a67e

git-author:

Thomas Klute <thomas2.klute@…> (10/31/16 19:42:11)

git-committer:

Thomas Klute <thomas2.klute@…> (11/01/16 07:20:42)

Message:

New directive GnuTLSOCSPCheckNonce

Some CAs refuse to send nonces in their OCSP responses, probably
because that way they can cache responses. This makes nonce
verification fail, so give the user an option disable it.

File:

• include/mod_gnutls.h.in (modified) (1 diff)

include/mod_gnutls.h.in

@@ -213 +213 @@
     /* Enable OCSP stapling */
     unsigned char ocsp_staple;
+    /* Check nonce in OCSP responses? */
+    unsigned char ocsp_check_nonce;
     /* Read OCSP response for stapling from this file instead of
      * sending a request over HTTP */