This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new 9c6bb9d1b Stricter OCSP handling when soft-fail is disabled.
9c6bb9d1b is described below
commit 9c6bb9d1bd5f5597945dbb8aae1d191edb15d3c1
Author: Mark Thomas <[email protected]>
AuthorDate: Fri Aug 28 18:11:45 2026 +0100
Stricter OCSP handling when soft-fail is disabled.
---
native/src/sslutils.c | 3 +++
xdocs/miscellaneous/changelog.xml | 3 +++
2 files changed, 6 insertions(+)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index f625f5998..39ff94992 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -1140,6 +1140,9 @@ static int ssl_ocsp_request(X509 *cert, X509 *issuer,
X509_STORE_CTX *ctx, int t
OCSP_REQUEST_free(req);
}
+ } else {
+ /* The AIA extension is not present or no URLs were found. */
+ X509_STORE_CTX_set_error(ctx, X509_V_ERR_UNABLE_TO_GET_CRL);
}
apr_pool_destroy(p);
return rv;
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index 3c9472f34..656653d43 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -84,6 +84,9 @@
<fix>
Make the processing of OCSP responses more robust. (markt)
</fix>
+ <fix>
+ Stricter OCSP handling when soft-fail is disabled. (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.15" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
