This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new f07198cc4 Stop OCSP checks once a cert in the trust store is reached
f07198cc4 is described below
commit f07198cc45476f057c013420466f26ceba43a2ed
Author: Mark Thomas <[email protected]>
AuthorDate: Tue Sep 22 12:49:48 2026 +0100
Stop OCSP checks once a cert in the trust store is reached
---
native/src/sslutils.c | 10 ++++++++--
xdocs/miscellaneous/changelog.xml | 7 +++++++
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 13d76018e..ce3433eb6 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -476,8 +476,14 @@ static int ssl_verify_OCSP(X509_STORE_CTX *ctx, int
timeout, int verifyFlags)
* is called if OpenSSL already successfully verified the certificate
* (parameter "ok" in SSL_callback_SSL_verify() must be true).
*/
- else if (X509_check_issued(cert,cert) == X509_V_OK) {
- /* don't do OCSP checking for valid self-issued certs */
+ else if (X509_check_issued(cert,cert) == X509_V_OK
+ || X509_STORE_CTX_get_error_depth(ctx) >=
X509_STORE_CTX_get_num_untrusted(ctx)) {
+ /* Don't do OCSP checking for valid self-issued certs, nor for a
certificate that is itself
+ * a trust anchor (present directly in the configured trust store
rather than supplied by the
+ * peer). A trust anchor is trusted unconditionally, so its own
revocation status is not
+ * checked. This aligns with JSSE's PKIXRevocationChecker, which
excludes the trust anchor
+ * of the certification path from revocation checking regardless of
whether it is self-signed.
+ */
X509_STORE_CTX_set_error(ctx, X509_V_OK);
return OCSP_STATUS_UNKNOWN;
}
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index ffc8e622a..331b1af52 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -41,6 +41,13 @@
Add support for configuring client-side TLSv1.2 pre-shared key callback.
(markt)
</add>
+ <fix>
+ Align the OCSP checking performed by <code>ssl_verify_OCSP()</code> with
+ the behaviour of Tomcat's JSSE based <code>SSLEngine</code>
+ implementation so that a certificate that is itself a trust anchor
+ (whether a self-signed root or a certificate trusted directly via the
+ configured trust store) is not subject to OCSP checking. (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.16" rtext="2026-09-07">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
