This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 0a4a18281ffbb12c7a7a321c861fe01f772ce240 Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 9 14:37:42 2025 +0300 If the OCSP response is null, the error is set as X509_V_ERR_APPLICATION_VERIFICATION (50). Should not pass our verification process. --- java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index 106dca39f7..225e327063 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -1173,7 +1173,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn errnum = X509_STORE_CTX_get_error(x509ctx); } else if (ocspResponse == V_OCSP_CERTSTATUS_UNKNOWN()) { errnum = X509_STORE_CTX_get_error(x509ctx); - if (errnum < 0) { + if (errnum == X509_V_ERR_APPLICATION_VERIFICATION() || errnum < 0) { ok = 0; } } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
