This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch 1.3.x in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 002d33b7edbd79b6994c51682c66a3442e25be3d Author: Mark Thomas <[email protected]> AuthorDate: Fri Aug 28 18:11:45 2026 +0100 Stricter OCSP handling when soft-fail is disabled. --- native/src/sslutils.c | 3 +++ xdocs/miscellaneous/changelog.xml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/native/src/sslutils.c b/native/src/sslutils.c index ddf87e59e..5d8e0ad48 100644 --- a/native/src/sslutils.c +++ b/native/src/sslutils.c @@ -1207,6 +1207,9 @@ static int ssl_ocsp_request(X509 *cert, X509 *issuer, X509_STORE_CTX *ctx, int t OCSP_REQUEST_free(req); } + } else { + /* The AIA extension is not present or no URLs were found. */ + X509_STORE_CTX_set_error(ctx, X509_V_ERR_UNABLE_TO_GET_CRL); } apr_pool_destroy(p); return rv; diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml index b1ecedd78..5ae740bc6 100644 --- a/xdocs/miscellaneous/changelog.xml +++ b/xdocs/miscellaneous/changelog.xml @@ -75,6 +75,9 @@ <fix> Make the processing of OCSP responses more robust. (markt) </fix> + <fix> + Stricter OCSP handling when soft-fail is disabled. (markt) + </fix> </changelog> </section> <section name="1.3.8" rtext="2026-06-15"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
