This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 2cdfb9ea12 Stricter OCSP handling when soft-fail is disabled.
2cdfb9ea12 is described below
commit 2cdfb9ea120075fd3d1f6b4ad0ed0e8125e19584
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Sep 2 19:42:27 2026 +0100
Stricter OCSP handling when soft-fail is disabled.
---
java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 7 +++++++
webapps/docs/changelog.xml | 3 +++
2 files changed, 10 insertions(+)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index d83658ae9c..c20d98d8e8 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1226,6 +1226,7 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
if (!MemorySegment.NULL.equals(issuer)) {
// sslutils.c ssl_ocsp_request(x509, issuer,
x509ctx);
int nid = X509_get_ext_by_NID(x509,
NID_info_access(), -1);
+ boolean requestAttempted = false;
if (nid >= 0) {
MemorySegment ext = X509_get_ext(x509, nid);
MemorySegment os =
X509_EXTENSION_get_data(ext);
@@ -1247,6 +1248,7 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
for (String urlString : urls) {
try {
URL url = (new
URI(urlString)).toURL();
+ requestAttempted = true;
ocspResponse =
processOCSPRequest(state,
url, issuer, x509, x509ctx, localArena);
if (log.isDebugEnabled()) {
@@ -1262,6 +1264,11 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
}
}
}
+ if (!requestAttempted) {
+ // The AIA extension is not present, no URLs
were found, or none of the URLs found
+ // could be used to make an OCSP request.
+ X509_STORE_CTX_set_error(x509ctx,
X509_V_ERR_UNABLE_TO_GET_CRL());
+ }
}
} finally {
if (!openssl_h_Compatibility.OPENSSL ||
openssl_h_Compatibility.OPENSSL3) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 9a7347db29..30e957af6d 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -205,6 +205,9 @@
<fix>
Make the processing of OCSP responses more robust. (markt)
</fix>
+ <fix>
+ Stricter OCSP handling when soft-fail is disabled. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
