Changeset f1147b6 in mod_gnutls

Timestamp:

Jun 18, 2016, 5:21:07 PM (7 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, main, master, proxy-ticket, upstream

Children:

3725f2d

Parents:

ef06c74

Message:

OCSP post config: Ensure OCSP URI or response file are set

If the certificate does not contain an OCSP URI and the vhost is not
using a response file mod_gnutls has no way to acquire a response. In
that case post config fails if stapling is enabled.

File:

• src/gnutls_ocsp.c (modified) (1 diff)

src/gnutls_ocsp.c

@@ -875 +875 @@
     sc->ocsp->uri = mgs_cert_get_ocsp_uri(pconf,
                                           sc->certs_x509_crt_chain[0]);
+    if (sc->ocsp->uri == NULL && sc->ocsp_response_file == NULL)
+    {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, server,
+                     "OCSP stapling is enabled for for %s:%d, but there is "
+                     "neither an OCSP URI in the certificate nor a "
+                     "GnuTLSOCSPResponseFile setting for this host!",
+                     server->server_hostname, server->addrs->host_port);
+        return HTTP_NOT_FOUND;
+    }
 
     sc->ocsp->trust = apr_palloc(pconf,